Fortinet Document Library

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:


Table of Contents

CLI Reference

config web-proxy global

Configure Web proxy global settings.

config web-proxy global

Description: Configure Web proxy global settings.

set ssl-cert {string}

set ssl-ca-cert {string}

set fast-policy-match [enable|disable]

set proxy-fqdn {string}

set max-request-length {integer}

set max-message-length {integer}

set strict-web-check [enable|disable]

set forward-proxy-auth [enable|disable]

set forward-server-affinity-timeout {integer}

set max-waf-body-cache-length {integer}

set webproxy-profile {string}

set learn-client-ip [enable|disable]

set learn-client-ip-from-header {option1}, {option2}, ...

set learn-client-ip-srcaddr <name1>, <name2>, ...

set learn-client-ip-srcaddr6 <name1>, <name2>, ...

end

config web-proxy global

Parameter

Description

Type

Size

Default

ssl-cert

SSL certificate for SSL interception.

string

Maximum length: 35

Fortinet_Factory

ssl-ca-cert

SSL CA certificate for SSL interception.

string

Maximum length: 35

Fortinet_CA_SSL

fast-policy-match

Enable/disable fast matching algorithm for explicit and transparent proxy policy.

option

-

enable

 

Option

Description

enable

Enable setting.

disable

Disable setting.

proxy-fqdn

Fully Qualified Domain Name to connect to the explicit web proxy.

string

Maximum length: 255

default.fqdn

max-request-length

Maximum length of HTTP request line .

integer

Minimum value: 2 Maximum value: 64

8

max-message-length

Maximum length of HTTP message, not including body .

integer

Minimum value: 16 Maximum value: 256

32

strict-web-check

Enable/disable strict web checking to block web sites that send incorrect headers that don't conform to HTTP 1.1.

option

-

disable

 

Option

Description

enable

Enable strict web checking.

disable

Disable strict web checking.

forward-proxy-auth

Enable/disable forwarding proxy authentication headers.

option

-

disable

 

Option

Description

enable

Enable forwarding proxy authentication headers.

disable

Disable forwarding proxy authentication headers.

forward-server-affinity-timeout

Period of time before the source IP's traffic is no longer assigned to the forwarding server .

integer

Minimum value: 6 Maximum value: 60

30

max-waf-body-cache-length

Maximum length of HTTP messages processed by Web Application Firewall .

integer

Minimum value: 10 Maximum value: 1024

32

webproxy-profile

Name of the web proxy profile to apply when explicit proxy traffic is allowed by default and traffic is accepted that does not match an explicit proxy policy.

string

Maximum length: 63

learn-client-ip

Enable/disable learning the client's IP address from headers.

option

-

disable

 

Option

Description

enable

Enable learning the client's IP address from headers.

disable

Disable learning the client's IP address from headers.

learn-client-ip-from-header

Learn client IP address from the specified headers.

option

-

 

Option

Description

true-client-ip

Learn the client IP address from the True-Client-IP header.

x-real-ip

Learn the client IP address from the X-Real-IP header.

x-forwarded-for

Learn the client IP address from the X-Forwarded-For header.

learn-client-ip-srcaddr <name>

Source address name (srcaddr or srcaddr6 must be set).

Address name.

string

Maximum length: 79

learn-client-ip-srcaddr6 <name>

IPv6 Source address name (srcaddr or srcaddr6 must be set).

Address name.

string

Maximum length: 79

config web-proxy global

Configure Web proxy global settings.

config web-proxy global

Description: Configure Web proxy global settings.

set ssl-cert {string}

set ssl-ca-cert {string}

set fast-policy-match [enable|disable]

set proxy-fqdn {string}

set max-request-length {integer}

set max-message-length {integer}

set strict-web-check [enable|disable]

set forward-proxy-auth [enable|disable]

set forward-server-affinity-timeout {integer}

set max-waf-body-cache-length {integer}

set webproxy-profile {string}

set learn-client-ip [enable|disable]

set learn-client-ip-from-header {option1}, {option2}, ...

set learn-client-ip-srcaddr <name1>, <name2>, ...

set learn-client-ip-srcaddr6 <name1>, <name2>, ...

end

config web-proxy global

Parameter

Description

Type

Size

Default

ssl-cert

SSL certificate for SSL interception.

string

Maximum length: 35

Fortinet_Factory

ssl-ca-cert

SSL CA certificate for SSL interception.

string

Maximum length: 35

Fortinet_CA_SSL

fast-policy-match

Enable/disable fast matching algorithm for explicit and transparent proxy policy.

option

-

enable

 

Option

Description

enable

Enable setting.

disable

Disable setting.

proxy-fqdn

Fully Qualified Domain Name to connect to the explicit web proxy.

string

Maximum length: 255

default.fqdn

max-request-length

Maximum length of HTTP request line .

integer

Minimum value: 2 Maximum value: 64

8

max-message-length

Maximum length of HTTP message, not including body .

integer

Minimum value: 16 Maximum value: 256

32

strict-web-check

Enable/disable strict web checking to block web sites that send incorrect headers that don't conform to HTTP 1.1.

option

-

disable

 

Option

Description

enable

Enable strict web checking.

disable

Disable strict web checking.

forward-proxy-auth

Enable/disable forwarding proxy authentication headers.

option

-

disable

 

Option

Description

enable

Enable forwarding proxy authentication headers.

disable

Disable forwarding proxy authentication headers.

forward-server-affinity-timeout

Period of time before the source IP's traffic is no longer assigned to the forwarding server .

integer

Minimum value: 6 Maximum value: 60

30

max-waf-body-cache-length

Maximum length of HTTP messages processed by Web Application Firewall .

integer

Minimum value: 10 Maximum value: 1024

32

webproxy-profile

Name of the web proxy profile to apply when explicit proxy traffic is allowed by default and traffic is accepted that does not match an explicit proxy policy.

string

Maximum length: 63

learn-client-ip

Enable/disable learning the client's IP address from headers.

option

-

disable

 

Option

Description

enable

Enable learning the client's IP address from headers.

disable

Disable learning the client's IP address from headers.

learn-client-ip-from-header

Learn client IP address from the specified headers.

option

-

 

Option

Description

true-client-ip

Learn the client IP address from the True-Client-IP header.

x-real-ip

Learn the client IP address from the X-Real-IP header.

x-forwarded-for

Learn the client IP address from the X-Forwarded-For header.

learn-client-ip-srcaddr <name>

Source address name (srcaddr or srcaddr6 must be set).

Address name.

string

Maximum length: 79

learn-client-ip-srcaddr6 <name>

IPv6 Source address name (srcaddr or srcaddr6 must be set).

Address name.

string

Maximum length: 79