config firewall vip

Configure virtual IP for IPv4.

config firewall vip

Description: Configure virtual IP for IPv4.

edit <name>

set id {integer}

set uuid {uuid}

set comment {var-string}

set type [static-nat|load-balance|...]

set dns-mapping-ttl {integer}

set ldb-method [static|round-robin|...]

set src-filter <range1>, <range2>, ...

set service <name1>, <name2>, ...

set extip {user}

set extaddr <name1>, <name2>, ...

set mappedip <range1>, <range2>, ...

set mapped-addr {string}

set extintf {string}

set arp-reply [disable|enable]

set server-type [http|https|...]

set http-redirect [enable|disable]

set persistence [none|http-cookie|...]

set nat-source-vip [disable|enable]

set portforward [disable|enable]

set protocol [tcp|udp|...]

set extport {user}

set mappedport {user}

set gratuitous-arp-interval {integer}

set srcintf-filter <interface-name1>, <interface-name2>, ...

set portmapping-type [1-to-1|m-to-n]

config realservers

Description: Select the real servers that this server load balancing VIP will distribute traffic to.

edit <id>

set type [ip|address]

set address {string}

set ip {ipv4-address-any}

set port {integer}

set status [active|standby|...]

set weight {integer}

set holddown-interval {integer}

set healthcheck [disable|enable|...]

set http-host {string}

set max-connections {integer}

set monitor <name1>, <name2>, ...

set client-ip {user}

next

end

set http-cookie-domain-from-host [disable|enable]

set http-cookie-domain {string}

set http-cookie-path {string}

set http-cookie-generation {integer}

set http-cookie-age {integer}

set http-cookie-share [disable|same-ip]

set https-cookie-secure [disable|enable]

set http-multiplex [enable|disable]

set http-ip-header [enable|disable]

set http-ip-header-name {string}

set outlook-web-access [disable|enable]

set weblogic-server [disable|enable]

set websphere-server [disable|enable]

set ssl-mode [half|full]

set ssl-certificate {string}

set ssl-dh-bits [768|1024|...]

set ssl-algorithm [high|medium|...]

config ssl-cipher-suites

Description: SSL/TLS cipher suites acceptable from a client, ordered by priority.

edit <priority>

set cipher [TLS-AES-128-GCM-SHA256|TLS-AES-256-GCM-SHA384|...]

set versions {option1}, {option2}, ...

next

end

set ssl-server-algorithm [high|medium|...]

config ssl-server-cipher-suites

Description: SSL/TLS cipher suites to offer to a server, ordered by priority.

edit <priority>

set cipher [TLS-AES-128-GCM-SHA256|TLS-AES-256-GCM-SHA384|...]

set versions {option1}, {option2}, ...

next

end

set ssl-pfs [require|deny|...]

set ssl-min-version [ssl-3.0|tls-1.0|...]

set ssl-max-version [ssl-3.0|tls-1.0|...]

set ssl-server-min-version [ssl-3.0|tls-1.0|...]

set ssl-server-max-version [ssl-3.0|tls-1.0|...]

set ssl-send-empty-frags [enable|disable]

set ssl-client-fallback [disable|enable]

set ssl-client-renegotiation [allow|deny|...]

set ssl-client-session-state-type [disable|time|...]

set ssl-client-session-state-timeout {integer}

set ssl-client-session-state-max {integer}

set ssl-client-rekey-count {integer}

set ssl-server-session-state-type [disable|time|...]

set ssl-server-session-state-timeout {integer}

set ssl-server-session-state-max {integer}

set ssl-http-location-conversion [enable|disable]

set ssl-http-match-host [enable|disable]

set ssl-hpkp [disable|enable|...]

set ssl-hpkp-primary {string}

set ssl-hpkp-backup {string}

set ssl-hpkp-age {integer}

set ssl-hpkp-report-uri {var-string}

set ssl-hpkp-include-subdomains [disable|enable]

set ssl-hsts [disable|enable]

set ssl-hsts-age {integer}

set ssl-hsts-include-subdomains [disable|enable]

set monitor <name1>, <name2>, ...

set max-embryonic-connections {integer}

set color {integer}

next

end

config firewall vip

Parameter

Description

Type

Size

Default

id

Custom defined ID.

integer

Minimum value: 0 Maximum value: 65535

0

uuid

Universally Unique Identifier (UUID; automatically assigned but can be manually reset).

uuid

Not Specified

00000000-0000-0000-0000-000000000000

comment

Comment.

var-string

Maximum length: 255

type

Configure a static NAT, load balance, server load balance, DNS translation, or FQDN VIP.

option

-

static-nat

 

Option

Description

static-nat

Static NAT.

load-balance

Load balance.

server-load-balance

Server load balance.

dns-translation

DNS translation.

fqdn

Fully qualified domain name.

dns-mapping-ttl

DNS mapping TTL (Set to zero to use TTL in DNS response, default = 0).

integer

Minimum value: 0 Maximum value: 604800

0

ldb-method

Method used to distribute sessions to real servers.

option

-

static

 

Option

Description

static

Distribute to server based on source IP.

round-robin

Distribute to server based round robin order.

weighted

Distribute to server based on weight.

least-session

Distribute to server with lowest session count.

least-rtt

Distribute to server with lowest Round-Trip-Time.

first-alive

Distribute to the first server that is alive.

http-host

Distribute to server based on host field in HTTP header.

src-filter <range>

Source address filter. Each address must be either an IP/subnet (x.x.x.x/n) or a range (x.x.x.x-y.y.y.y). Separate addresses with spaces.

Source-filter range.

string

Maximum length: 79

service <name>

Service name.

Service name.

string

Maximum length: 79

extip

IP address or address range on the external interface that you want to map to an address or address range on the destination network.

user

Not Specified

extaddr <name>

External FQDN address name.

Address name.

string

Maximum length: 79

mappedip <range>

IP address or address range on the destination network to which the external IP address is mapped.

Mapped IP range.

string

Maximum length: 79

mapped-addr

Mapped FQDN address name.

string

Maximum length: 79

extintf

Interface connected to the source network that receives the packets that will be forwarded to the destination network.

string

Maximum length: 35

arp-reply

Enable to respond to ARP requests for this virtual IP address. Enabled by default.

option

-

enable

 

Option

Description

disable

Disable ARP reply.

enable

Enable ARP reply.

server-type

Protocol to be load balanced by the virtual server (also called the server load balance virtual IP).

option

-

 

Option

Description

http

HTTP

https

HTTPS

imaps

IMAPS

pop3s

POP3S

smtps

SMTPS

ssl

SSL

tcp

TCP

udp

UDP

ip

IP

http-redirect

Enable/disable redirection of HTTP to HTTPS

option

-

disable

 

Option

Description

enable

Enable redirection of HTTP to HTTPS.

disable

Disable redirection of HTTP to HTTPS.

persistence

Configure how to make sure that clients connect to the same server every time they make a request that is part of the same session.

option

-

none

 

Option

Description

none

None.

http-cookie

HTTP cookie.

ssl-session-id

SSL session ID.

nat-source-vip

Enable/disable forcing the source NAT mapped IP to the external IP for all traffic.

option

-

disable

 

Option

Description

disable

Force only the source NAT mapped IP to the external IP for traffic egressing the external interface of the VIP.

enable

Force the source NAT mapped IP to the external IP for all traffic.

portforward

Enable/disable port forwarding.

option

-

disable

 

Option

Description

disable

Disable port forward.

enable

Enable port forward.

protocol

Protocol to use when forwarding packets.

option

-

tcp

 

Option

Description

tcp

TCP.

udp

UDP.

sctp

SCTP.

icmp

ICMP.

extport

Incoming port number range that you want to map to a port number range on the destination network.

user

Not Specified

mappedport

Port number range on the destination network to which the external port number range is mapped.

user

Not Specified

gratuitous-arp-interval

Enable to have the VIP send gratuitous ARPs. 0=disabled. Set from 5 up to 8640000 seconds to enable.

integer

Minimum value: 5 Maximum value: 8640000

0

srcintf-filter <interface-name>

Interfaces to which the VIP applies. Separate the names with spaces.

Interface name.

string

Maximum length: 79

portmapping-type

Port mapping type.

option

-

1-to-1

 

Option

Description

1-to-1

One to one.

m-to-n

Many to many.

http-cookie-domain-from-host

Enable/disable use of HTTP cookie domain from host field in HTTP.

option

-

disable

 

Option

Description

disable

Disable use of HTTP cookie domain from host field in HTTP (use http-cooke-domain setting).

enable

Enable use of HTTP cookie domain from host field in HTTP.

http-cookie-domain

Domain that HTTP cookie persistence should apply to.

string

Maximum length: 35

http-cookie-path

Limit HTTP cookie persistence to the specified path.

string

Maximum length: 35

http-cookie-generation

Generation of HTTP cookie to be accepted. Changing invalidates all existing cookies.

integer

Minimum value: 0 Maximum value: 4294967295

0

http-cookie-age

Time in minutes that client web browsers should keep a cookie. Default is 60 minutes. 0 = no time limit.

integer

Minimum value: 0 Maximum value: 525600

60

http-cookie-share

Control sharing of cookies across virtual servers. same-ip means a cookie from one virtual server can be used by another. Disable stops cookie sharing.

option

-

same-ip

 

Option

Description

disable

Only allow HTTP cookie to match this virtual server.

same-ip

Allow HTTP cookie to match any virtual server with same IP.

https-cookie-secure

Enable/disable verification that inserted HTTPS cookies are secure.

option

-

disable

 

Option

Description

disable

Do not mark cookie as secure, allow sharing between an HTTP and HTTPS connection.

enable

Mark inserted cookie as secure, cookie can only be used for HTTPS a connection.

http-multiplex

Enable/disable HTTP multiplexing.

option

-

disable

 

Option

Description

enable

Enable HTTP session multiplexing.

disable

Disable HTTP session multiplexing.

http-ip-header

For HTTP multiplexing, enable to add the original client IP address in the XForwarded-For HTTP header.

option

-

disable

 

Option

Description

enable

Enable adding HTTP header.

disable

Disable adding HTTP header.

http-ip-header-name

For HTTP multiplexing, enter a custom HTTPS header name. The original client IP address is added to this header. If empty, X-Forwarded-For is used.

string

Maximum length: 35

outlook-web-access

Enable to add the Front-End-Https header for Microsoft Outlook Web Access.

option

-

disable

 

Option

Description

disable

Disable Outlook Web Access support.

enable

Enable Outlook Web Access support.

weblogic-server

Enable to add an HTTP header to indicate SSL offloading for a WebLogic server.

option

-

disable

 

Option

Description

disable

Do not add HTTP header indicating SSL offload for WebLogic server.

enable

Add HTTP header indicating SSL offload for WebLogic server.

websphere-server

Enable to add an HTTP header to indicate SSL offloading for a WebSphere server.

option

-

disable

 

Option

Description

disable

Do not add HTTP header indicating SSL offload for WebSphere server.

enable

Add HTTP header indicating SSL offload for WebSphere server.

ssl-mode

Apply SSL offloading between the client and the FortiGate (half) or from the client to the FortiGate and from the FortiGate to the server (full).

option

-

half

 

Option

Description

half

Client to FortiGate SSL.

full

Client to FortiGate and FortiGate to Server SSL.

ssl-certificate

The name of the SSL certificate to use for SSL acceleration.

string

Maximum length: 35

ssl-dh-bits

Number of bits to use in the Diffie-Hellman exchange for RSA encryption of SSL sessions.

option

-

2048

 

Option

Description

768

768-bit Diffie-Hellman prime.

1024

1024-bit Diffie-Hellman prime.

1536

1536-bit Diffie-Hellman prime.

2048

2048-bit Diffie-Hellman prime.

3072

3072-bit Diffie-Hellman prime.

4096

4096-bit Diffie-Hellman prime.

ssl-algorithm

Permitted encryption algorithms for SSL sessions according to encryption strength.

option

-

high

 

Option

Description

high

High encryption. Allow only AES and ChaCha.

medium

Medium encryption. Allow AES, ChaCha, 3DES, and RC4.

low

Low encryption. Allow AES, ChaCha, 3DES, RC4, and DES.

custom

Custom encryption. Use config ssl-cipher-suites to select the cipher suites that are allowed.

ssl-server-algorithm

Permitted encryption algorithms for the server side of SSL full mode sessions according to encryption strength.

option

-

client

 

Option

Description

high

High encryption. Allow only AES and ChaCha.

medium

Medium encryption. Allow AES, ChaCha, 3DES, and RC4.

low

Low encryption. Allow AES, ChaCha, 3DES, RC4, and DES.

custom

Custom encryption. Use ssl-server-cipher-suites to select the cipher suites that are allowed.

client

Use the same encryption algorithms for both client and server sessions.

ssl-pfs

Select the cipher suites that can be used for SSL perfect forward secrecy (PFS). Applies to both client and server sessions.

option

-

require

 

Option

Description

require

Allow only Diffie-Hellman cipher-suites, so PFS is applied.

deny

Allow only non-Diffie-Hellman cipher-suites, so PFS is not applied.

allow

Allow use of any cipher suite so PFS may or may not be used depending on the cipher suite selected.

ssl-min-version

Lowest SSL/TLS version acceptable from a client.

option

-

tls-1.1

 

Option

Description

ssl-3.0

SSL 3.0.

tls-1.0

TLS 1.0.

tls-1.1

TLS 1.1.

tls-1.2

TLS 1.2.

tls-1.3

TLS 1.3.

ssl-max-version

Highest SSL/TLS version acceptable from a client.

option

-

tls-1.3

 

Option

Description

ssl-3.0

SSL 3.0.

tls-1.0

TLS 1.0.

tls-1.1

TLS 1.1.

tls-1.2

TLS 1.2.

tls-1.3

TLS 1.3.

ssl-server-min-version

Lowest SSL/TLS version acceptable from a server. Use the client setting by default.

option

-

client

 

Option

Description

ssl-3.0

SSL 3.0.

tls-1.0

TLS 1.0.

tls-1.1

TLS 1.1.

tls-1.2

TLS 1.2.

tls-1.3

TLS 1.3.

client

Use same value as client configuration.

ssl-server-max-version

Highest SSL/TLS version acceptable from a server. Use the client setting by default.

option

-

client

 

Option

Description

ssl-3.0

SSL 3.0.

tls-1.0

TLS 1.0.

tls-1.1

TLS 1.1.

tls-1.2

TLS 1.2.

tls-1.3

TLS 1.3.

client

Use same value as client configuration.

ssl-send-empty-frags

Enable/disable sending empty fragments to avoid CBC IV attacks (SSL 3.0 & TLS 1.0 only). May need to be disabled for compatibility with older systems.

option

-

enable

 

Option

Description

enable

Send empty fragments.

disable

Do not send empty fragments.

ssl-client-fallback

Enable/disable support for preventing Downgrade Attacks on client connections (RFC 7507).

option

-

enable

 

Option

Description

disable

Disable.

enable

Enable.

ssl-client-renegotiation

Allow, deny, or require secure renegotiation of client sessions to comply with RFC 5746.

option

-

secure

 

Option

Description

allow

Allow a SSL client to renegotiate.

deny

Abort any client initiated SSL re-negotiation attempt.

secure

Abort any client initiated SSL re-negotiation attempt that does not use RFC 5746 Secure Renegotiation.

ssl-client-session-state-type

How to expire SSL sessions for the segment of the SSL connection between the client and the FortiGate.

option

-

both

 

Option

Description

disable

Do not keep session states.

time

Expire session states after this many minutes.

count

Expire session states when this maximum is reached.

both

Expire session states based on time or count, whichever occurs first.

ssl-client-session-state-timeout

Number of minutes to keep client to FortiGate SSL session state.

integer

Minimum value: 1 Maximum value: 14400

30

ssl-client-session-state-max

Maximum number of client to FortiGate SSL session states to keep.

integer

Minimum value: 1 Maximum value: 10000

1000

ssl-client-rekey-count

Maximum length of data in MB before triggering a client rekey (0 = disable).

integer

Minimum value: 200 Maximum value: 1048576

0

ssl-server-session-state-type

How to expire SSL sessions for the segment of the SSL connection between the server and the FortiGate.

option

-

both

 

Option

Description

disable

Do not keep session states.

time

Expire session states after this many minutes.

count

Expire session states when this maximum is reached.

both

Expire session states based on time or count, whichever occurs first.

ssl-server-session-state-timeout

Number of minutes to keep FortiGate to Server SSL session state.

integer

Minimum value: 1 Maximum value: 14400

60

ssl-server-session-state-max

Maximum number of FortiGate to Server SSL session states to keep.

integer

Minimum value: 1 Maximum value: 10000

100

ssl-http-location-conversion

Enable to replace HTTP with HTTPS in the reply's Location HTTP header field.

option

-

disable

 

Option

Description

enable

Enable HTTP location conversion.

disable

Disable HTTP location conversion.

ssl-http-match-host

Enable/disable HTTP host matching for location conversion.

option

-

enable

 

Option

Description

enable

Match HTTP host in response header.

disable

Do not match HTTP host.

ssl-hpkp

Enable/disable including HPKP header in response.

option

-

disable

 

Option

Description

disable

Do not add a HPKP header to each HTTP response.

enable

Add a HPKP header to each a HTTP response.

report-only

Add a HPKP Report-Only header to each HTTP response.

ssl-hpkp-primary

Certificate to generate primary HPKP pin from.

string

Maximum length: 79

ssl-hpkp-backup

Certificate to generate backup HPKP pin from.

string

Maximum length: 79

ssl-hpkp-age

Number of seconds the client should honour the HPKP setting.

integer

Minimum value: 60 Maximum value: 157680000

5184000

ssl-hpkp-report-uri

URL to report HPKP violations to.

var-string

Maximum length: 255

ssl-hpkp-include-subdomains

Indicate that HPKP header applies to all subdomains.

option

-

disable

 

Option

Description

disable

HPKP header does not apply to subdomains.

enable

HPKP header applies to subdomains.

ssl-hsts

Enable/disable including HSTS header in response.

option

-

disable

 

Option

Description

disable

Do not add a HSTS header to each a HTTP response.

enable

Add a HSTS header to each HTTP response.

ssl-hsts-age

Number of seconds the client should honour the HSTS setting.

integer

Minimum value: 60 Maximum value: 157680000

5184000

ssl-hsts-include-subdomains

Indicate that HSTS header applies to all subdomains.

option

-

disable

 

Option

Description

disable

HSTS header does not apply to subdomains.

enable

HSTS header applies to subdomains.

monitor <name>

Name of the health check monitor to use when polling to determine a virtual server's connectivity status.

Health monitor name.

string

Maximum length: 79

max-embryonic-connections

Maximum number of incomplete connections.

integer

Minimum value: 0 Maximum value: 100000

1000

color