"<routing-policy_name>"

Enter the name of the HTTP content routing policy. The maximum length is 63 characters.

To display the list of existing policies, enter:

edit ?

server-pool "<server-pool_name>"

Enter the name of the server pool to which FortiWeb forwards traffic when the traffic matches rules in this policy.

For details, see server-policy server-pool.

<entry_index>

match-object {http-host | http-request | url-parameter | http-referer | http-cookie | http-header | source-ip | x509-certificate-Subject | x509-certificate-Extension | https-sni | geo-ip}

Enter the type of object that FortiWeb examines for matching values:

• http-host—Host: field
• http-request—A URL
• url-parameter—A URL parameter and value
• http-referer—Referer: field
• http-cookie—A cookie name and value
• http-header—A header name and value
• source-ip—An IPv4 address or address range or IPv6 address or address range
• x509-certificate-Subject—A specified Relative Distinguished Name (RDN) in the X509 certificate Subject field. Also specify x509-subject-name.
• x509-certificate-Extension—Additional fields that the extensions field adds to the X509 certificate
• https-sni— Select this option so that FortiWeb will forward requests based on the SNI in the SSL handshake.
• geo-ip— Select this option so that FortiWeb matches against the IP addresses from specified countries.

match-condition {match-begin | match-end | match-sub | match-domain | match-dir | match-reg | ip-range | ip-range6 | equal}

Enter the type of value to match. Values can be a literal value that appears in the object or a regular expression.

The value of match-object {http-host | http-request | url-parameter | http-referer | http-cookie | http-header | source-ip | x509-certificate-Subject | x509-certificate-Extension | https-sni | geo-ip} determines which content types you can specify.

If match-object is http-host, http-request, http-referer, or x509-certificate-Extension:

• match-begin—The object to match begins with the specified string.
• match-end—The object to match ends with the specified string.
• match-sub—The object to match contains the specified string.
• equal—The object to match is the specified string.

If match-object is http-host only:

• match-domain—The object to match contains the specified string between the periods in a domain name.
  
  For example, if match-expression is abc, the condition matches the following hostnames:
  
  dname1.abc.com
dname1.dname2.abc.com
  
  However, the same Match Simple String value does not match the following hostnames:
  
  abc.com
dname.abc
  
  

If match-object is http-request:

• match-dir—The object to match contains the specified string between delimiting characters (slash) in a domain name.
  
  For example, if match-expression is abc, the condition matches the following hostnames:
  
  test.com/abc/
test.com/dir1/abc/
  
  However, the same match-string value does not match the following hostnames:
  
  test.com/abc
test.abc.com

If match-object is source-ip:

• ip-range—The source IP to match is an IPv4 IP address or within a range of IPv4 IP addresses.
• ip-range6—The source IP to match is an IPv6 IP address or within a range of IPv6 IP addresses.

If match-object is http-host, http-request, http-referer, source-ip, or x509-certificate-Extension:

• match-reg—The object to match has a value that matches the specified regular expression.

x509-subject-name {E | CN | OU | O | L | ST | C}

match-expression "<match-expression_str>"

Enter a value to match in the object element specified by match-object {http-host | http-request | url-parameter | http-referer | http-cookie | http-header | source-ip | x509-certificate-Subject | x509-certificate-Extension | https-sni | geo-ip} and match-condition.

Examples:

• A literal URL, such as /index.php, that a matching HTTP request contains.
• An expression, such as ^/*.php, that matches a URL.

Tip: When you enter a regular expression using the web UI, you can validate its syntax.

name "<name_str>"

Enter the name of the object to match. The value can be a literal value or a regular expression.

For example, the name of a cookie embedded by traffic controller software on one of the servers.

Available only if match-object {http-host | http-request | url-parameter | http-referer | http-cookie | http-header | source-ip | x509-certificate-Subject | x509-certificate-Extension | https-sni | geo-ip} is url-parameter, http-cookie, or http-header.

name-match-condition {match-begin | match-end | match-sub | match-reg | equal}

Enter the type of value to match. The value is specified by name and can be a literal value that appears in the object or a regular expression.

• match-begin—The name to match begins with the specified string.
• match-end—The name to match ends with the specified string.
• match-sub—The name to match contains the specified string.
• equal—The name to match is the specified string.
• match-reg—The name to match matches the specified regular expression.

value "<value_str>"

Enter the object value to match. The value can be a literal value or a regular expression.

Available if match-object {http-host | http-request | url-parameter | http-referer | http-cookie | http-header | source-ip | x509-certificate-Subject | x509-certificate-Extension | https-sni | geo-ip} is url-parameter, http-cookie, or http-header.

value-match-condition {match-begin | match-end | match-sub | match-reg | equal}

Enter the type of value to match. The value is specified by value and can be a literal value or a regular expression.

• match-begin—The value to match begins with the specified string.
• match-end—The value to match ends with the specified string.
• match-sub—The value to match contains the specified string.
• equal—The value to match is the specified string.
• match-reg—The value to match matches the specified regular expression.

start-ip "<start_ip>"

Enter the first IP address in a range of IP addresses.

Available if match-condition {match-begin | match-end | match-sub | match-domain | match-dir | match-reg | ip-range | ip-range6 | equal} is ip-range or ip-range6.

end-ip "<end_ip>"

Enter the last IP address in a range of IP addresses.

Available if match-object {http-host | http-request | url-parameter | http-referer | http-cookie | http-header | source-ip | x509-certificate-Subject | x509-certificate-Extension | https-sni | geo-ip} is source-ip

Select countries where the IP addresses originate.