Fortinet white logo
Fortinet white logo

CLI Reference

config dlp profile

config dlp profile

Configure DLP profiles.

config dlp profile
    Description: Configure DLP profiles.
    edit <name>
        set comment {var-string}
        set dlp-log [enable|disable]
        set extended-log [enable|disable]
        set fabric-force-sync [enable|disable]
        set fabric-object [enable|disable]
        set fabric-object-source [member|local|...]
        set feature-set [flow|proxy]
        set fortidata-error-action [log-only|block|...]
        set fortidata-scan-timeout {integer}
        set full-archive-proto {option1}, {option2}, ...
        set nac-quar-log [enable|disable]
        set replacemsg-group {string}
        config rule
            Description: Set up DLP rules for this profile.
            edit <id>
                set action [allow|log-only|...]
                set archive [disable|enable]
                set expiry {user}
                set file-size {integer}
                set file-type {integer}
                set filter-by [sensor|label|...]
                set label {string}
                set match-percentage {integer}
                set name {string}
                set proto {option1}, {option2}, ...
                set sensitivity <name1>, <name2>, ...
                set sensor <name1>, <name2>, ...
                set severity [info|low|...]
                set type [file|message]
            next
        end
        set summary-proto {option1}, {option2}, ...
        set uuid {uuid}
    next
end

config dlp profile

Parameter

Description

Type

Size

Default

comment

Comment.

var-string

Maximum length: 255

dlp-log

Enable/disable DLP logging.

option

-

enable

Option

Description

enable

Enable DLP logging.

disable

Disable DLP logging.

extended-log

Enable/disable extended logging for data loss prevention.

option

-

disable

Option

Description

enable

Enable setting.

disable

Disable setting.

fabric-force-sync *

Enable/disable forced synchronization of configuration objects from the root FortiGate unit to the downstream devices. Configuration conflict check is skipped.

option

-

disable

Option

Description

enable

Enable forced synchronization of configuration objects from the root FortiGate unit to the downstream devices.

disable

Disable forced synchronization of configuration objects from the root FortiGate unit to the downstream devices.

fabric-object *

Security Fabric global object setting.

option

-

disable

Option

Description

enable

Object is set as a security fabric-wide global object.

disable

Object is local to this security fabric member.

fabric-object-source *

Source of truth for fabric object.

option

-

root

Option

Description

member

Source of truth for this object is a non-root member of fabric.

local

Source of truth for this object is this security fabric member.

root

Source of truth for this object is the root of the fabric.

feature-set

Flow/proxy feature set.

option

-

flow

Option

Description

flow

Flow feature set.

proxy

Proxy feature set.

fortidata-error-action

Action to take if FortiData query fails.

option

-

block

Option

Description

log-only

Log failure, but allow the file.

block

Block the file.

ignore

Behave as if FortiData returned no match.

fortidata-scan-timeout *

FortiData inline scan timeout in seconds (10 - 30, default = 15).

integer

Minimum value: 10 Maximum value: 30

15

full-archive-proto

Protocols to always content archive.

option

-

Option

Description

smtp

SMTP.

pop3

POP3.

imap

IMAP.

http-get

HTTP GET.

http-post

HTTP POST.

ftp

FTP.

nntp

NNTP.

mapi

MAPI.

ssh

SFTP and SCP.

cifs

CIFS.

websocket

WEBSOCKET.

nac-quar-log

Enable/disable NAC quarantine logging.

option

-

disable

Option

Description

enable

Enable NAC quarantine logging.

disable

Disable NAC quarantine logging.

name

Name of the DLP profile.

string

Maximum length: 47

replacemsg-group

Replacement message group used by this DLP profile.

string

Maximum length: 35

summary-proto

Protocols to always log summary.

option

-

Option

Description

smtp

SMTP.

pop3

POP3.

imap

IMAP.

http-get

HTTP GET.

http-post

HTTP POST.

ftp

FTP.

nntp

NNTP.

mapi

MAPI.

ssh

SFTP and SCP.

cifs

CIFS.

websocket

WEBSOCKET.

uuid *

Universally Unique Identifier (UUID; automatically assigned but can be manually reset).

uuid

Not Specified

00000000-0000-0000-0000-000000000000

* This parameter may not exist in some models.

config rule

Parameter

Description

Type

Size

Default

action

Action to take with content that this DLP profile matches.

option

-

allow

Option

Description

allow

Allow the content to pass through the FortiGate and do not create a log message.

log-only

Allow the content to pass through the FortiGate, but write a log message.

block

Block the content and write a log message.

quarantine-ip

Quarantine all traffic from the IP address and write a log message.

archive

Enable/disable DLP archiving.

option

-

disable

Option

Description

disable

No DLP archiving.

enable

Enable full DLP archiving.

expiry

Quarantine duration in days, hours, minutes (format = dddhhmm).

user

Not Specified

5m

file-size

Match files greater than or equal to this size (KB).

integer

Minimum value: 0 Maximum value: 1644544 **

0

file-type

Select the number of a DLP file pattern table to match.

integer

Minimum value: 0 Maximum value: 4294967295

0

filter-by

Select the type of content to match.

option

-

none

Option

Description

sensor

Use DLP sensors to match content.

label

Use DLP labels to match content.

fingerprint

Match against a fingerprint sensitivity.

encrypted

Look for encrypted files.

none

No content scan.

id

ID.

integer

Minimum value: 0 Maximum value: 4294967295

0

label

Select DLP label.

string

Maximum length: 35

match-percentage *

Percentage of fingerprints in the fingerprint databases designated with the selected sensitivity to match.

integer

Minimum value: 1 Maximum value: 100

10

name

Filter name.

string

Maximum length: 35

proto

Check messages or files over one or more of these protocols.

option

-

Option

Description

smtp

SMTP.

pop3

POP3.

imap

IMAP.

http-get

HTTP GET.

http-post

HTTP POST.

ftp

FTP.

nntp

NNTP.

mapi

MAPI.

ssh

SFTP and SCP.

cifs

CIFS.

websocket

WEBSOCKET.

sensitivity <name> *

Select a DLP file pattern sensitivity to match.

Select a DLP sensitivity.

string

Maximum length: 35

sensor <name>

Select DLP sensors.

Sensor name.

string

Maximum length: 35

severity

Select the severity or threat level that matches this filter.

option

-

medium

Option

Description

info

Informational.

low

Low.

medium

Medium.

high

High.

critical

Critical.

type

Select whether to check the content of messages (an email message) or files (downloaded files or email attachments).

option

-

file

Option

Description

file

Check the contents of downloaded or attached files.

message

Check the contents of email messages, web pages, etc.

* This parameter may not exist in some models.

** Values may differ between models.

config dlp profile

config dlp profile

Configure DLP profiles.

config dlp profile
    Description: Configure DLP profiles.
    edit <name>
        set comment {var-string}
        set dlp-log [enable|disable]
        set extended-log [enable|disable]
        set fabric-force-sync [enable|disable]
        set fabric-object [enable|disable]
        set fabric-object-source [member|local|...]
        set feature-set [flow|proxy]
        set fortidata-error-action [log-only|block|...]
        set fortidata-scan-timeout {integer}
        set full-archive-proto {option1}, {option2}, ...
        set nac-quar-log [enable|disable]
        set replacemsg-group {string}
        config rule
            Description: Set up DLP rules for this profile.
            edit <id>
                set action [allow|log-only|...]
                set archive [disable|enable]
                set expiry {user}
                set file-size {integer}
                set file-type {integer}
                set filter-by [sensor|label|...]
                set label {string}
                set match-percentage {integer}
                set name {string}
                set proto {option1}, {option2}, ...
                set sensitivity <name1>, <name2>, ...
                set sensor <name1>, <name2>, ...
                set severity [info|low|...]
                set type [file|message]
            next
        end
        set summary-proto {option1}, {option2}, ...
        set uuid {uuid}
    next
end

config dlp profile

Parameter

Description

Type

Size

Default

comment

Comment.

var-string

Maximum length: 255

dlp-log

Enable/disable DLP logging.

option

-

enable

Option

Description

enable

Enable DLP logging.

disable

Disable DLP logging.

extended-log

Enable/disable extended logging for data loss prevention.

option

-

disable

Option

Description

enable

Enable setting.

disable

Disable setting.

fabric-force-sync *

Enable/disable forced synchronization of configuration objects from the root FortiGate unit to the downstream devices. Configuration conflict check is skipped.

option

-

disable

Option

Description

enable

Enable forced synchronization of configuration objects from the root FortiGate unit to the downstream devices.

disable

Disable forced synchronization of configuration objects from the root FortiGate unit to the downstream devices.

fabric-object *

Security Fabric global object setting.

option

-

disable

Option

Description

enable

Object is set as a security fabric-wide global object.

disable

Object is local to this security fabric member.

fabric-object-source *

Source of truth for fabric object.

option

-

root

Option

Description

member

Source of truth for this object is a non-root member of fabric.

local

Source of truth for this object is this security fabric member.

root

Source of truth for this object is the root of the fabric.

feature-set

Flow/proxy feature set.

option

-

flow

Option

Description

flow

Flow feature set.

proxy

Proxy feature set.

fortidata-error-action

Action to take if FortiData query fails.

option

-

block

Option

Description

log-only

Log failure, but allow the file.

block

Block the file.

ignore

Behave as if FortiData returned no match.

fortidata-scan-timeout *

FortiData inline scan timeout in seconds (10 - 30, default = 15).

integer

Minimum value: 10 Maximum value: 30

15

full-archive-proto

Protocols to always content archive.

option

-

Option

Description

smtp

SMTP.

pop3

POP3.

imap

IMAP.

http-get

HTTP GET.

http-post

HTTP POST.

ftp

FTP.

nntp

NNTP.

mapi

MAPI.

ssh

SFTP and SCP.

cifs

CIFS.

websocket

WEBSOCKET.

nac-quar-log

Enable/disable NAC quarantine logging.

option

-

disable

Option

Description

enable

Enable NAC quarantine logging.

disable

Disable NAC quarantine logging.

name

Name of the DLP profile.

string

Maximum length: 47

replacemsg-group

Replacement message group used by this DLP profile.

string

Maximum length: 35

summary-proto

Protocols to always log summary.

option

-

Option

Description

smtp

SMTP.

pop3

POP3.

imap

IMAP.

http-get

HTTP GET.

http-post

HTTP POST.

ftp

FTP.

nntp

NNTP.

mapi

MAPI.

ssh

SFTP and SCP.

cifs

CIFS.

websocket

WEBSOCKET.

uuid *

Universally Unique Identifier (UUID; automatically assigned but can be manually reset).

uuid

Not Specified

00000000-0000-0000-0000-000000000000

* This parameter may not exist in some models.

config rule

Parameter

Description

Type

Size

Default

action

Action to take with content that this DLP profile matches.

option

-

allow

Option

Description

allow

Allow the content to pass through the FortiGate and do not create a log message.

log-only

Allow the content to pass through the FortiGate, but write a log message.

block

Block the content and write a log message.

quarantine-ip

Quarantine all traffic from the IP address and write a log message.

archive

Enable/disable DLP archiving.

option

-

disable

Option

Description

disable

No DLP archiving.

enable

Enable full DLP archiving.

expiry

Quarantine duration in days, hours, minutes (format = dddhhmm).

user

Not Specified

5m

file-size

Match files greater than or equal to this size (KB).

integer

Minimum value: 0 Maximum value: 1644544 **

0

file-type

Select the number of a DLP file pattern table to match.

integer

Minimum value: 0 Maximum value: 4294967295

0

filter-by

Select the type of content to match.

option

-

none

Option

Description

sensor

Use DLP sensors to match content.

label

Use DLP labels to match content.

fingerprint

Match against a fingerprint sensitivity.

encrypted

Look for encrypted files.

none

No content scan.

id

ID.

integer

Minimum value: 0 Maximum value: 4294967295

0

label

Select DLP label.

string

Maximum length: 35

match-percentage *

Percentage of fingerprints in the fingerprint databases designated with the selected sensitivity to match.

integer

Minimum value: 1 Maximum value: 100

10

name

Filter name.

string

Maximum length: 35

proto

Check messages or files over one or more of these protocols.

option

-

Option

Description

smtp

SMTP.

pop3

POP3.

imap

IMAP.

http-get

HTTP GET.

http-post

HTTP POST.

ftp

FTP.

nntp

NNTP.

mapi

MAPI.

ssh

SFTP and SCP.

cifs

CIFS.

websocket

WEBSOCKET.

sensitivity <name> *

Select a DLP file pattern sensitivity to match.

Select a DLP sensitivity.

string

Maximum length: 35

sensor <name>

Select DLP sensors.

Sensor name.

string

Maximum length: 35

severity

Select the severity or threat level that matches this filter.

option

-

medium

Option

Description

info

Informational.

low

Low.

medium

Medium.

high

High.

critical

Critical.

type

Select whether to check the content of messages (an email message) or files (downloaded files or email attachments).

option

-

file

Option

Description

file

Check the contents of downloaded or attached files.

message

Check the contents of email messages, web pages, etc.

* This parameter may not exist in some models.

** Values may differ between models.