"<http-constraint_name>"

Enter the name of a new or existing HTTP protocol constraint. The maximum length is 63 characters.

To display the list of existing constraints, enter:

edit ?

<constraint_name>-check {enable | disable}

<constraint_name>-action {alert | alert_deny | block-period | deny_no_log}

Select one of the following actions that the FortiWeb appliance will perform when an HTTP request violates one of the rules:

• alert—Accept the request and generate an alert email and/or log message.

• alert_deny—Block the request (or reset the connection) and generate an alert email and/or log message.
  

• deny_no_log—Deny a request. Do not generate a log message.

You can customize the web page that FortiWeb returns to the client with the HTTP status code. For details, see system replacemsg.

• block-period—Block subsequent requests from the client for a number of seconds. Also configure <constraint_name>-block-period <seconds_int>.

  Note: If FortiWeb is deployed behind a NAT load balancer, when using this option, you must also define an X-header that indicates the original client’s IP (see waf x-forwarded-for). Failure to do so may cause FortiWeb to block all connections when it detects a violation of this type.

Caution: This setting is ignored when the value of monitor-mode {enable | disable} is enable.

Note: Logging and/or alert email will occur only if enabled and configured. For details, see log disk and log alertMail.

Note: If you select an auto-learning profile with this rule, you should select alert. If the action is alert_deny, for example, the FortiWeb appliance will block the request or reset the connection when it detects an attack, resulting in incomplete session information for the auto-learning feature. For details about auto-learning requirements, see waf web-protection-profile autolearning-profile.

Note: This is not a single setting. Configure the action setting for each violation type. The number of action settings equals the number of violation types.

For example, for maximum HTTP header length violations, you might type the accompanying setting:

set max-http-header-length-action alert

Note: Available actions vary depending on operating mode and protocol parameter.

<constraint_name>-severity {High | Medium | Low | Info}

Select the severity level to use in logs and reports generated when a violation of the rule occurs.

Note: This is not a single setting. Configure the severity setting for each violation type. The number of severity settings equals the number of violation types.

For example, for maximum HTTP header length violations, you might type the accompanying setting:

set max-http-header-length-severity High

<constraint_name>-trigger "<trigger-policy_name>"

Enter the name of the trigger to apply when this rule is violated (see log trigger-policy). The maximum length is 63 characters.

To display the list of existing trigger policies, enter:

set trigger ?

Note: This is not a single setting. Configure the trigger setting for each violation type. The number of trigger settings equals the number of violation types.
For example, for maximum HTTP header length violations, you might type accompanying setting:

set max-http-header-length-trigger trigger-policy1

<constraint_name>-block-period <seconds_int>