Fortinet white logo
Fortinet docs logo DOCUMENT LIBRARY
Fortinet white logo
Fortinet docs logo DOCUMENT LIBRARY
Products Best Practices Hardware Guides Products A-Z
Summary
By Solution
By 4D Pillars
By Cloud
Secure Networking
Unified SASE
Security Operations
Secure SD-WAN
Secure Access Service Edge (SASE)
ZTNA
LAN Edge
Identity and Access Management
Next Generation Firewall
Public Cloud
Private Cloud
FortiCloud
Secure Networking
  • Hybrid Mesh Firewall
  • NOC Management
  • LAN
  • WAN
    • More >>
    Unified SASE
  • Single Vendor SASE
  • Cloud Network Security
  • Secure Endpoint Connectivity
  • Web Application / API Protection
    • More >>
    Security Operations
  • Security Operations Automation
  • Identity
  • Early Detection & Prevention
    • More >>
    Secure Networking
  • Hybrid Mesh Firewall
  • NOC Management
  • LAN
  • WAN
  • Communication & Surveillance
    • Unified SASE
  • Single Vendor SASE
  • Secure Endpoint Connectivity
  • Cloud Network Security
  • Cloud-Native Security
  • Web Application / API Protection
    • Security Operations
  • Security Operations Automation
  • Endpoint
  • Data Protection
  • Identity
  • Email
  • Early Detection & Prevention
  • Expert Services
  • Edge Firewall
  • Orchestration & management
  • SD Branch
  • Application Delivery
  • Single Vendor SASE
  • Secure Endpoint Connectivity
  • Secure Private Access
  • Thin Edge
  • Identity
  • Application Gateway
  • Enterprise Asset Management
  • Endpoint Agent
  • Agentless Security Posture
  • Identity
  • Wireless
  • Switching
  • Identity
  • Privilege Acccess Management
  • Next Generation Firewall
  • Orchestration & management
  • Expert Services
  • All
  • All
  • Account Management
  • SAAS Management
  • SAAS Application Security
  • Managed Services
  • Platform as a service (PAAS)
  • Other SAAS Services
    • 4D Resources
    Solution Hubs
  • 4D Pillars
  • Cloud
  • Popular Solutions

    • CLI Reference

    Home FortiProxy 7.6.0 CLI Reference
    7.6.0
    7.6.0
    7.4.6
    7.4.5
    7.4.4
    7.4.3
    7.4.2
    7.4.1
    7.4.0
    7.2.12
    7.2.11
    7.2.10
    7.2.9
    7.2.8
    7.2.7
    7.2.6
    7.2.5
    7.2.4
    7.2.3
    7.2.2
    7.2.1
    7.0.19
    7.0.18
    7.0.17
    7.0.15
    7.0.14
    7.0.13
    7.0.12
    7.0.11
    7.0.10
    7.0.9
    7.0.8
    7.0.7
    2.0.13
    2.0.12
    2.0.0
    1.2.4

    config dlp profile

    config dlp profile

    Configure DLP profiles.

    config dlp profile
    Description: Configure DLP profiles.
    edit <name>
        set comment {var-string}
        set feature-set [flow|proxy]
        set replacemsg-group {string}
        config rule
            Description: Set up DLP rules for this profile.
            edit <id>
                set name {string}
                set severity [info|low|...]
                set type [file|message]
                set proto {option1}, {option2}, ...
                set filter-by [sensor|mip|...]
                set file-size {integer}
                set sensitivity <name1>, <name2>, ...
                set match-percentage {integer}
                set file-type {integer}
                set sensor <name1>, <name2>, ...
                set label {string}
                set archive [disable|enable]
                set action [allow|log-only|...]
                set expiry {user}
            next
        end
        set dlp-log [enable|disable]
        set nac-quar-log [enable|disable]
        set full-archive-proto {option1}, {option2}, ...
        set summary-proto {option1}, {option2}, ...
    next
end

    config dlp profile

    Parameter

    Description

    Type

    Size

    Default

    name

    Name of the DLP profile.

    string

    Maximum length: 35

    comment

    Comment.

    var-string

    Maximum length: 255

    feature-set

    Flow/proxy feature set.

    option

    -

    proxy

    Option

    Description

    flow

    Flow feature set.

    proxy

    Proxy feature set.

    replacemsg-group

    Replacement message group used by this DLP profile.

    string

    Maximum length: 35

    dlp-log

    Enable/disable DLP logging.

    option

    -

    enable

    Option

    Description

    enable

    Enable DLP logging.

    disable

    Disable DLP logging.

    nac-quar-log

    Enable/disable NAC quarantine logging.

    option

    -

    disable

    Option

    Description

    enable

    Enable NAC quarantine logging.

    disable

    Disable NAC quarantine logging.

    full-archive-proto

    Protocols to always content archive.

    option

    -

    Option

    Description

    smtp

    SMTP.

    pop3

    POP3.

    imap

    IMAP.

    http-get

    HTTP GET.

    http-post

    HTTP POST.

    ftp

    FTP.

    nntp

    NNTP.

    mapi

    MAPI.

    ssh

    SFTP and SCP.

    cifs

    CIFS.

    summary-proto

    Protocols to always log summary.

    option

    -

    Option

    Description

    smtp

    SMTP.

    pop3

    POP3.

    imap

    IMAP.

    http-get

    HTTP GET.

    http-post

    HTTP POST.

    ftp

    FTP.

    nntp

    NNTP.

    mapi

    MAPI.

    ssh

    SFTP and SCP.

    cifs

    CIFS.

    config rule

    Parameter

    Description

    Type

    Size

    Default

    id

    ID.

    integer

    Minimum value: 0 Maximum value: 4294967295

    0

    name

    Filter name.

    string

    Maximum length: 35

    severity

    Select the severity or threat level that matches this filter.

    option

    -

    medium

    Option

    Description

    info

    Informational.

    low

    Low.

    medium

    Medium.

    high

    High.

    critical

    Critical.

    type

    Select whether to check the content of messages (an email message) or files (downloaded files or email attachments).

    option

    -

    file

    Option

    Description

    file

    Check the contents of downloaded or attached files.

    message

    Check the contents of email messages, web pages, etc.

    proto

    Check messages or files over one or more of these protocols.

    option

    -

    Option

    Description

    smtp

    SMTP.

    pop3

    POP3.

    imap

    IMAP.

    http-get

    HTTP GET.

    http-post

    HTTP POST.

    ftp

    FTP.

    nntp

    NNTP.

    mapi

    MAPI.

    ssh

    SFTP and SCP.

    cifs

    CIFS.

    filter-by

    Select the type of content to match.

    option

    -

    none

    Option

    Description

    sensor

    Use DLP sensors to match content.

    mip

    Use MIP label dictionary to match content.

    fingerprint

    Match against a fingerprint sensitivity.

    encrypted

    Look for encrypted files.

    none

    No content scan.

    file-size

    Match files greater than or equal to this size (KB).

    integer

    Minimum value: 0 Maximum value: 26843136

    0

    sensitivity <name>

    Select a DLP file pattern sensitivity to match.

    Select a DLP sensitivity.

    string

    Maximum length: 35

    match-percentage

    Percentage of fingerprints in the fingerprint databases designated with the selected sensitivity to match.

    integer

    Minimum value: 1 Maximum value: 100

    10

    file-type

    Select the number of a DLP file pattern table to match.

    integer

    Minimum value: 0 Maximum value: 4294967295

    0

    sensor <name>

    Select DLP sensors.

    Address name.

    string

    Maximum length: 35

    label

    MIP label dictionary.

    string

    Maximum length: 35

    archive

    Enable/disable DLP archiving.

    option

    -

    disable

    Option

    Description

    disable

    No DLP archiving.

    enable

    Enable full DLP archiving.

    action

    Action to take with content that this DLP profile matches.

    option

    -

    allow

    Option

    Description

    allow

    Allow the content to pass through the FortiGate and do not create a log message.

    log-only

    Allow the content to pass through the FortiGate, but write a log message.

    block

    Block the content and write a log message.

    quarantine-ip

    Quarantine all traffic from the IP address and write a log message.

    expiry

    Quarantine duration in days, hours, minutes (format = dddhhmm).

    user

    Not Specified

    5m
    Previous
    Next

    config dlp profile

    config dlp profile

    Configure DLP profiles.

    config dlp profile
    Description: Configure DLP profiles.
    edit <name>
        set comment {var-string}
        set feature-set [flow|proxy]
        set replacemsg-group {string}
        config rule
            Description: Set up DLP rules for this profile.
            edit <id>
                set name {string}
                set severity [info|low|...]
                set type [file|message]
                set proto {option1}, {option2}, ...
                set filter-by [sensor|mip|...]
                set file-size {integer}
                set sensitivity <name1>, <name2>, ...
                set match-percentage {integer}
                set file-type {integer}
                set sensor <name1>, <name2>, ...
                set label {string}
                set archive [disable|enable]
                set action [allow|log-only|...]
                set expiry {user}
            next
        end
        set dlp-log [enable|disable]
        set nac-quar-log [enable|disable]
        set full-archive-proto {option1}, {option2}, ...
        set summary-proto {option1}, {option2}, ...
    next
end

    config dlp profile

    Parameter

    Description

    Type

    Size

    Default

    name

    Name of the DLP profile.

    string

    Maximum length: 35

    comment

    Comment.

    var-string

    Maximum length: 255

    feature-set

    Flow/proxy feature set.

    option

    -

    proxy

    Option

    Description

    flow

    Flow feature set.

    proxy

    Proxy feature set.

    replacemsg-group

    Replacement message group used by this DLP profile.

    string

    Maximum length: 35

    dlp-log

    Enable/disable DLP logging.

    option

    -

    enable

    Option

    Description

    enable

    Enable DLP logging.

    disable

    Disable DLP logging.

    nac-quar-log

    Enable/disable NAC quarantine logging.

    option

    -

    disable

    Option

    Description

    enable

    Enable NAC quarantine logging.

    disable

    Disable NAC quarantine logging.

    full-archive-proto

    Protocols to always content archive.

    option

    -

    Option

    Description

    smtp

    SMTP.

    pop3

    POP3.

    imap

    IMAP.

    http-get

    HTTP GET.

    http-post

    HTTP POST.

    ftp

    FTP.

    nntp

    NNTP.

    mapi

    MAPI.

    ssh

    SFTP and SCP.

    cifs

    CIFS.

    summary-proto

    Protocols to always log summary.

    option

    -

    Option

    Description

    smtp

    SMTP.

    pop3

    POP3.

    imap

    IMAP.

    http-get

    HTTP GET.

    http-post

    HTTP POST.

    ftp

    FTP.

    nntp

    NNTP.

    mapi

    MAPI.

    ssh

    SFTP and SCP.

    cifs

    CIFS.

    config rule

    Parameter

    Description

    Type

    Size

    Default

    id

    ID.

    integer

    Minimum value: 0 Maximum value: 4294967295

    0

    name

    Filter name.

    string

    Maximum length: 35

    severity

    Select the severity or threat level that matches this filter.

    option

    -

    medium

    Option

    Description

    info

    Informational.

    low

    Low.

    medium

    Medium.

    high

    High.

    critical

    Critical.

    type

    Select whether to check the content of messages (an email message) or files (downloaded files or email attachments).

    option

    -

    file

    Option

    Description

    file

    Check the contents of downloaded or attached files.

    message

    Check the contents of email messages, web pages, etc.

    proto

    Check messages or files over one or more of these protocols.

    option

    -

    Option

    Description

    smtp

    SMTP.

    pop3

    POP3.

    imap

    IMAP.

    http-get

    HTTP GET.

    http-post

    HTTP POST.

    ftp

    FTP.

    nntp

    NNTP.

    mapi

    MAPI.

    ssh

    SFTP and SCP.

    cifs

    CIFS.

    filter-by

    Select the type of content to match.

    option

    -

    none

    Option

    Description

    sensor

    Use DLP sensors to match content.

    mip

    Use MIP label dictionary to match content.

    fingerprint

    Match against a fingerprint sensitivity.

    encrypted

    Look for encrypted files.

    none

    No content scan.

    file-size

    Match files greater than or equal to this size (KB).

    integer

    Minimum value: 0 Maximum value: 26843136

    0

    sensitivity <name>

    Select a DLP file pattern sensitivity to match.

    Select a DLP sensitivity.

    string

    Maximum length: 35

    match-percentage

    Percentage of fingerprints in the fingerprint databases designated with the selected sensitivity to match.

    integer

    Minimum value: 1 Maximum value: 100

    10

    file-type

    Select the number of a DLP file pattern table to match.

    integer

    Minimum value: 0 Maximum value: 4294967295

    0

    sensor <name>

    Select DLP sensors.

    Address name.

    string

    Maximum length: 35

    label

    MIP label dictionary.

    string

    Maximum length: 35

    archive

    Enable/disable DLP archiving.

    option

    -

    disable

    Option

    Description

    disable

    No DLP archiving.

    enable

    Enable full DLP archiving.

    action

    Action to take with content that this DLP profile matches.

    option

    -

    allow

    Option

    Description

    allow

    Allow the content to pass through the FortiGate and do not create a log message.

    log-only

    Allow the content to pass through the FortiGate, but write a log message.

    block

    Block the content and write a log message.

    quarantine-ip

    Quarantine all traffic from the IP address and write a log message.

    expiry

    Quarantine duration in days, hours, minutes (format = dddhhmm).

    user

    Not Specified

    5m
    Previous
    Next