Fortinet white logo
Fortinet white logo

CLI Reference

waf websocket-security rule

waf websocket-security rule

Use this command to configure WebSocket rule related settings.

To use this command, your administrator account’s access control profile must have either w or rw permission to the wafgrp area. For details, see Permissions.

Syntax

config waf websocket-security rule

edit websocket-security_rule_name

set host-status {enable | disable}

set host <host_str>

set url-type {plain | regular}

set url <url_str>

set block-websocket-traffic {enable | disable}

set action {alert | deny_no_log | alert_deny}

set max-frame-size <max-frame-size_int>

set max-message-size <max-message-size_int>

set block-extensions {enable | disable}

set enable-attack-signatures {enable | disable}

set allow-plain-text {enable | disable}

set allow-binary-text {enable | disable}

config allowed-origin-list

edit allowed-origin-list <allowed-origin-list_id>

set origin <origin_str>

end

Variable

Description

Default

websocket-security_rule_name

Enter the WebSocket security rule name. No default.

host-status {enable | disable}

Enable to compare the WebSocket security rule to the Host: field in the HTTP header. No default.

host <host_str>

Select the IP address or fully qualified domain name (FQDN) of the protected host to which this rule applies.
This option is available only if Host Status is enabled.
No default.

url-type {plain | regular}

Select whether the URL Pattern field will contain a literal URL (Simple String), or a regular expression designed to match multiple URLs (Regular Expression). Plain

url <url_str>

The URL which hosts the web page containing the user input fields you want to protect. No default.

block-websocket-traffic {enable | disable}

Enable to deny the WebSocket traffic, and FortiWeb will not check any WebSocket related traffic. This option is disabled by default. Disable

action {alert | deny_no_log | alert_deny}

Select which action the FortiWeb appliance will take when it detects a violation.
Alert—Accept the connection and generate an alert email and/or log message.
Alert & Deny—Block the request (or reset the connection) and generate an alert and/or log message.
Deny (no log)—Block the request (or reset the connection).
Alert

max-frame-size <max-frame-size_int>

Specifies the maximum acceptable frame header and body size in bytes. The valid range is 0–2147483647 bytes. 64

max-message-size <max-message-size_int>

Specifies the maximum acceptable message header and body size in bytes. The valid range is 0–2147483647 bytes. 1024

block-extensions {enable | disable}

Enable to not check the extension header in WebSocket handshake packet. By default, this option is disabled. Disable

enable-attack-signatures {enable | disable}

Enable to detect attack in WebSocket message body. But if WebSocket traffic has extension header and allow extension header in WebSocket security rule, FortiWeb can not detect attack signatures. When attack signature is detected, the actions FortiWeb will take follow those of related signatures. Disable

allow-plain-text {enable | disable}

Enable to allow detecting the plain text. Enable

allow-binary-text {enable | disable}

Enable to allow detecting the binary text. Enable

allowed-origin-list <allowed-origin-list_id>

Enter the origin list ID in WebSocket handshake packet. No default.

origin <origin_str>

Related topics

waf websocket-security rule

waf websocket-security rule

Use this command to configure WebSocket rule related settings.

To use this command, your administrator account’s access control profile must have either w or rw permission to the wafgrp area. For details, see Permissions.

Syntax

config waf websocket-security rule

edit websocket-security_rule_name

set host-status {enable | disable}

set host <host_str>

set url-type {plain | regular}

set url <url_str>

set block-websocket-traffic {enable | disable}

set action {alert | deny_no_log | alert_deny}

set max-frame-size <max-frame-size_int>

set max-message-size <max-message-size_int>

set block-extensions {enable | disable}

set enable-attack-signatures {enable | disable}

set allow-plain-text {enable | disable}

set allow-binary-text {enable | disable}

config allowed-origin-list

edit allowed-origin-list <allowed-origin-list_id>

set origin <origin_str>

end

Variable

Description

Default

websocket-security_rule_name

Enter the WebSocket security rule name. No default.

host-status {enable | disable}

Enable to compare the WebSocket security rule to the Host: field in the HTTP header. No default.

host <host_str>

Select the IP address or fully qualified domain name (FQDN) of the protected host to which this rule applies.
This option is available only if Host Status is enabled.
No default.

url-type {plain | regular}

Select whether the URL Pattern field will contain a literal URL (Simple String), or a regular expression designed to match multiple URLs (Regular Expression). Plain

url <url_str>

The URL which hosts the web page containing the user input fields you want to protect. No default.

block-websocket-traffic {enable | disable}

Enable to deny the WebSocket traffic, and FortiWeb will not check any WebSocket related traffic. This option is disabled by default. Disable

action {alert | deny_no_log | alert_deny}

Select which action the FortiWeb appliance will take when it detects a violation.
Alert—Accept the connection and generate an alert email and/or log message.
Alert & Deny—Block the request (or reset the connection) and generate an alert and/or log message.
Deny (no log)—Block the request (or reset the connection).
Alert

max-frame-size <max-frame-size_int>

Specifies the maximum acceptable frame header and body size in bytes. The valid range is 0–2147483647 bytes. 64

max-message-size <max-message-size_int>

Specifies the maximum acceptable message header and body size in bytes. The valid range is 0–2147483647 bytes. 1024

block-extensions {enable | disable}

Enable to not check the extension header in WebSocket handshake packet. By default, this option is disabled. Disable

enable-attack-signatures {enable | disable}

Enable to detect attack in WebSocket message body. But if WebSocket traffic has extension header and allow extension header in WebSocket security rule, FortiWeb can not detect attack signatures. When attack signature is detected, the actions FortiWeb will take follow those of related signatures. Disable

allow-plain-text {enable | disable}

Enable to allow detecting the plain text. Enable

allow-binary-text {enable | disable}

Enable to allow detecting the binary text. Enable

allowed-origin-list <allowed-origin-list_id>

Enter the origin list ID in WebSocket handshake packet. No default.

origin <origin_str>

Related topics