system web-service
Use this command to configure the rate limit for REST APIs, including the maximum concurrent REST API requests (overall and for individual IP addresses), and how fast the system should perform, in terms of how many requests and responses are processed per second. It also configures connections for FortiMail webmail and per-user quarantines.
|
Valid value ranges for certain commands vary by FortiMail model. See FortiMail Maximum Values. |
Syntax
config system web-service
set https-redirect-status {enable | disable}
set https-redirect-host <fortimail_fqdn>
set max-active-session-admin <limit_int>
set max-active-session-restful <limit_int>
set max-concurrent-request-admin <limit_int>
set max-concurrent-request-all <limit_int>
set max-concurrent-request-ms365 <limit_int>
set max-concurrent-request-per-ip <limit_int
set max-concurrent-request-restful <limit_int>
set max-concurrent-request-webmail <limit_int>
set max-request-rate-admin <limit_int>
set max-request-rate-ms365 <limit_int>
set max-request-rate-restful <limit_int>
set max-request-rate-webmail <limit_int>
set rest-api-status {enable | disable}
set webmail-session-ttl <seconds_int>
config exempt-list
edit <list_index>
next
end
end
|
Variable |
Description |
Default |
|
Enter a number to identify the entry. |
|
|
|
Enter an IP address and netmask that you want to exempt from concurrent request rate limits. |
|
|
| https-redirect-status {enable | disable} |
Enable to redirect insecure HTTP requests to secure access using HTTPS. This setting affects all FortiMail URLs: REST APIs, administrator GUI, FortiMail webmail, and per-user quarantines. Note: For this setting to take effect, you must also enable both HTTP and HTTPS access protocols on the network interface(s) that receive these connections. FortiMail cannot redirect HTTP if it is not listening for it. See allowaccess {ping http https snmp ssh telnet}. |
enable |
| https-redirect-host <fortimail_fqdn> |
Enter the fully qualified domain name (FQDN) to use in HTTPS redirects. |
|
|
Enter the maximum number of active administrator sessions. |
200 |
|
|
Enter the maximum number of active RESTful sessions. |
10 |
|
|
Enter the maximum number of concurrent admin portal requests. |
50 |
|
|
Enter the maximum number of concurrent HTTP requests from all clients. |
0 |
|
|
Enter the maximum number of concurrent Microsoft Office 365 requests permitted. |
100 |
|
|
Enter the maximum number of concurrent HTTP requests for a single IP address. |
0 |
|
|
Enter the maximum number of concurrent RESTful requests. |
20 |
|
|
Enter the maximum number of concurrent webmail portal requests. |
200 |
|
|
Enter the maximum request rate (per second) for administrators. |
0 |
|
|
Enter the maximum request rate (per second) for Microsoft Office 365. |
100 |
|
|
Enter the maximum request rate (per second) to the REST API. |
50 |
|
|
Enter the maximum request rate (per second) for webmail. |
0 |
|
| rest-api-status {enable | disable} |
Enable or disable REST API access. Note: For this setting to take effect, you must also enable HTTPS access protocols on the network interface(s) that receive these connections. FortiMail cannot respond to an API requestif it is not listening for it. See allowaccess {ping http https snmp ssh telnet}. |
disable |
|
Enter the amount of time, in seconds, that an inactive FortiMail webmail session is still valid. The maximum value is 600 seconds (10 minutes). Enter While a webmail user is logged in, their browser periodically sends a request to FortiMail. This GUI heartbeat keeps the session alive — even if the user is idle (they do not open any email,etc.). Heartbeats are not sent if the
FortiMail waits for the heartbeat to reconnect. If it does not (the session time to live (TTL) elapses), then the session expires and the user is automatically logged out. Otherwise an idle session can continue until the idle timeout occurs (see idle-timeout {enable | disable}). Tip: If your network connection is reliable, you can use a smaller session TTL for better security and performance. Note: Before the session TTL elapses, users may still need to log in again if they:
|
60 |