"<policy_name>"

Enter the name of the policy. The maximum length is 63 characters.

To display the list of existing policies, enter:

edit ?

allow-hosts "<hosts_name>"

Enter the name of a protected hosts group to allow or reject connections based upon whether the Host: field in the HTTP header is empty or does or does not match the protected hosts group. The maximum length is 63 characters.

To display the list of existing groups, enter:

edit ?

If you do not select a protected hosts group, FortiWeb accepts pr blocks requests based upon other criteria in the policy or protection profile, but regardless of the Host: field in the HTTP header.

Note: Unlike HTTP 1.1, HTTP 1.0 does not require the Host: field. The FortiWeb appliance does not block HTTP 1.0 requests because they do not have this field, regardless of whether or not you have selected a protected hosts group.

block-port <port_int>

Enter the number of the physical network interface port that FortiWeb uses to send TCP RST (reset) packets when a request violates the policy. The valid range varies by the number of physical ports on the NIC.

For example, to send TCP RST from port1, enter:

set block-port port1

Available only when the operating mode is Offline Protection.

case-sensitive {enable | disable}

Enable to differentiate uniform resource locators (URLs) according to upper case and lower case letters for features that act upon the URLs in the headers of HTTP requests, such as start page rules, black list rules, white list rules, and page access rules.

For example, when enabled, an HTTP request involving http://www.Example.com/ would not match protection profile features that specify http://www.example.com (difference highlighted in bold).

certificate "<certificate_name>"

Enter the name of the certificate that FortiWeb uses to encrypt or decrypt SSL-secured connections. The maximum length is 63 characters.

To display the list of existing certificates, enter:

edit ?

If sni {enable | disable} is enable, FortiWeb uses a Server Name Indication (SNI) configuration instead of or in addition to this server certificate. For details, see sni {enable | disable}.

This option is used only if https-service "<service_name>" is configured.

client-certificate-forwarding {enable | disable}

Enable to include the X.509 personal certificate presented by the client during the SSL/TLS handshake, if any, in an X-Client-Cert: HTTP header when forwarding the traffic to the protected web server.

FortiWeb still validates the client certificate itself, but this can be useful if the web server requires the client certificate for the purpose of server-side identity-based functionality.

client-certificate-forwarding-cert-header "<header_str>"

Enter a custom certificate header that will include the Base64 certificate of the X.509 personal certificate presented by the client during the SSL/TLS handshake when it forwards the traffic to the protected web server.

client-certificate-forwarding-sub-header "<header_str>"

client-real-ip {enable | disable}

Enter enable to configure FortiWeb to use the source IP address of the client that originated the request when it connects to a back-end server on behalf of that client.

By default, when the operation mode is Reverse Proxy, the source IP for connections between FortiWeb and back-end servers is the address of a FortiWeb network interface.

Note: To ensure FortiWeb receives the server's response, configure FortiWeb as the server’s gateway.

Available only if the operating mode is Reverse Proxy.

client-timeout <seconds_int>

Enter the amount of time (in seconds) that FortiWeb will keep open a connection with an idle client that isn't sending data. The valid range is 1–1200. A value of 0 means that there is no timeout.

comment "<comment_str>"

data-capture-port <port_int>

Enter the network interface of incoming traffic that the policy attempts to apply a profile to. The IP address is ignored.

Available only if the operating mode is offline inspection.

deployment-mode {server-pool | http-content-routing | offline-protection | transparent-servers | wccp-servers}

Specify the distribution method that FortiWeb uses when it forwards connections accepted by this policy.

• server-pool—Forwards connections to a server pool. Depending on the pool configuration, FortiWeb either forwards connections to a single physical server or domain server or distributes the connection among the pool members. Also configure server-pool "<server-pool_name>". This option is available only if the operating mode is Reverse Proxy mode.
• http-content-routing—Use HTTP content routing to route HTTP requests to a specific server pool. This option is available only if the FortiWeb appliance is operating in Reverse Proxy mode.
• offline-detection — Allows connections to pass through the FortiWeb appliance and applies an Offline Protection profile. Also configure server-pool "<server-pool_name>". This is the only option available if operating mode is Offline Protection.
• transparent-servers—Allows connections to pass through the FortiWeb appliance and applies a protection profile. Also configure server-pool "<server-pool_name>". This is the only option available when the operating mode is either True Transparent Proxy or Transparent Inspection.
• wccp-servers—FortiWeb is a Web Cache Communication Protocol (WCCP) client that receives traffic from a FortiGate configured as a WCCP server. Also configure server-pool "<server-pool_name>". This is the only option available when the operation mode is WCCP.

ftp-protection-profile <profile_name>

Enter the FTP security profile to apply to connections that this policy monitors. If you haven't created a profile yet, see waf ftp-propredefined-global-white-listtection-profile or instructions about creating one.

half-open-threshold <packets_int>

Enter the maximum number of TCP SYN packets, including retransmission, that FortiWeb allows to be sent per second to a destination address. If this threshold is exceeded, the FortiWeb appliance treats the traffic as a DoS attack and ignores additional traffic from that source address.

The valid range is 10–10,000.

Available only when the operating mode is Reverse Proxy or True Transparent Proxy and syncookie {enable | disable} is enabled.

hpkp-header "<hpkp_name>"

Select an HPKP profile, if any, to use to verify certificates when clients attempt to access a server.

HPKP prevents attackers from carrying out Man in the Middle (MITM) attacks with forged certificates.

Available only when the operating mode is Reverse Proxy.

hsts-header {enable | disable}

Enable to combat MITM attacks on HTTP by injecting the RFC 6797 (http://tools.ietf.org/html/rfc6797) strict transport security header into the reply, such as:

Strict-Transport-Security: max-age=31536000; includeSubDomains

This header forces the client to use HTTPS for subsequent visits to this domain. If the certificate does not validate, it also causes a fatal connection error: the client’s web browser does not display any dialog that allows the user to override the certificate mismatch error and continue.

Available only if https-service "<service_name>" is configured.

hsts-max-age <timeout_int>

Enter the time to live in seconds for the HSTS header.

Available only if hsts-header {enable | disable} is enabled.

The valid range is 3,600–31,536,000.

http2 {enable | disable}

FortiWeb's HTTP/2 security inspection is only supported for Revers Proxy mode and True Transparent Proxy mode. This option enables FortiWeb operating in Reverse Proxy mode (see opmode {offline-protection | reverse-proxy | transparent | transparent-inspection | wccp}) to negotiate HTTP/2 with clients via SSL ALPN (Application-Layer Protocol Negotiation) during the SSL handshake if the client's browser supports HTTP/2 protocol. With the HTTP/2 being enabled, FortiWebcan recognize HTTP/2 traffic and apply the security services to it. To enable HTTP/2 communication between the FortiWeb and back-end web servers for HTTP/2 inspections in Reverse Proxy mode, see http2 {enable | disable}.

Available only when opmode is set to reverse-proxy, deployment-mode {server-pool | http-content-routing | offline-protection | transparent-servers | wccp-servers} is set to server-pool and https-service "<service_name>" is set correctly. FortiWeb supports HTTP/2 only for HTTPS connections and HTTP Content Routing is not supported for HTTP/2.

When opmode is set to transparent and deployment-mode is set to transparent-servers, this is not available. It only requires http2 {enable | disable} to enable the HTTP/2 security inspections in True Transparent Proxy mode; this option here is not required. For more details about HTTP/2 support, see the FortiWeb Administration Guide:

http://docs.fortinet.com/fortiweb/admin-guides

http-header-timeout <seconds_int>

Enter the amount of time (in seconds) that FortiWeb will wait for the whole HTTP request header after a client sets up a TCP connection. The valid range is 0–1200. A value of 0 means that there is no timeout.

http-pipeline {enable | disable}

Specify whether FortiWeb accelerates transactions by bundling them inside the same TCP connection, instead of waiting for a response before sending/receiving the next request. This can increase performance when pages containing many images, scripts, and other auxiliary files are all hosted on the same domain, and therefore logically could use the same connection.

When FortiWeb is operating in Reverse Proxy or True Transparent Proxy mode, it can automatically use HTTP pipelining for requests with the following characteristics:

• HTTP version is 1.1
• The Connection general-header field does not include the "close" option (for example, Connection: close)
• The HTTP method is GET or HEAD

http-to-https {enable | disable}

Specify enable to automatically redirect all HTTP requests to the HTTPS service with the same URL and parameters.

Also configure https-service and ensure service uses port 443 (the default).

FortiWeb does not apply the protection profile for this policy (specified by server-policy policy) to the redirected traffic.

Available only when the operation mode is Reverse Proxy.

https-service "<service_name>"

Enter the custom or predefined service that defines the port number on which the virtual server receives HTTPS traffic. The maximum length is 63 characters.

To display the list of existing services, enter:

edit ?

Available only when the operating mode is Reverse Proxy. For other operation modes, use the server pool configuration to enable SSL inspection instead.

proxy-protocol {enable | disable}

Enable this option when proxy servers or load balancers are installed before FortiWeb, for example, when a load balancer with proxy protocol enabled is deployed before FortiWeb-VM on AWS.

When Proxy Protocol is enabled, FortiWeb can receive client connection

information in the proxy protocol package passed through proxy servers and load balancers.

use-proxy-protocol-addr {enable | disable}

Enable to use the source address of the proxy protocol in server policy.

If disabled, the source address of the connection will be used.

replacemsg <replacemsg_name>

Select the replacement message to apply to the policy.

intermediate-certificate-group "<CA-group_name>"

Enter the name of an intermediate certificate authority (CA) group, if any, that FortiWeb uses to validate the CA signing chain in a client’s certificate. The maximum length is 63 characters.

To display the list of existing groups, enter:

edit ?

Available only if https-service "<service_name>" is configured.

internal-cookie-httponly {enable | disable}

Enable to assign an httponly flag to internal cookies. This feature is independent of the Cookie Security policy, if any, that you have in use.

internal-cookie-secure {enable | disable}

Enable to assign a secure flag to internal cookies. This flag can only be assigned if the connection is over SSL. This feature is independent of the Cookie Security policy, if any, that you have in use.

monitor-mode {enable | disable}

Enable to override deny and redirect actions defined in the server protection rules for the selected policy. This setting enables FortiWeb to log attacks without performing the deny or redirect action.

Disable to allow FortiWeb to perform attack deny/redirect actions as defined by the server protection rules.

noparse {enable | disable}

Enable this option to apply the server policy as a pure proxy, without parsing the content. In this case, the policy allows all traffic to pass through the FortiWeb appliance without applying any protection rules. See also debug application http and debug flow trace.

This option applies to server policy only when the FortiWeb appliance operates in Reverse Proxy or True Transparent Proxy mode.

Caution: Use this only during debugging and for as brief a period as possible. This feature disables many protection features. See also http-parse-error-output {enable | disable}.

prefer-current-session {enable |disable}

Enable to forward subsequent requests from an identified client connection to the same server pool as the initial connection from the client.

This option allows FortiWeb to improve its performance by skipping the process of matching HTTP header content to content routing policies for connections it has already evaluated and routed.

Available only when deployment-mode {server-pool | http-content-routing | offline-protection | transparent-servers | wccp-servers} is http-content-routing.

protocol {HTTP | FTP | ADFSPIP}

Select one of the following:

• HTTP—Specifies that the server policy governs HTTP traffic. Specific options for configuring an HTTP server policy become available.
• FTP—Specifies that the server policy governs FTP traffic. Specific options for configuring an FTP server policy become available.
• ADFSPIP—Specifies that the server policy governs AD FS traffic. Specific options for configuring an AD FS server policy become available.

server-pool "<server-pool_name>"

Enter the name of the server pool whose members receive the connections.

To display the list of existing servers, enter:

edit ?

This field is applicable only if deployment-mode {server-pool | http-content-routing | offline-protection | transparent-servers | wccp-servers} is server-pool, offline-protection or transparent-servers.

Caution: Multiple virtual servers/policies can forward traffic to the same server pool. If you do this, consider the total maximum load of connections that all virtual servers forward to your server pool. This configuration can multiply traffic forwarded to your server pool, which can overload it and cause dropped connections.

service "<service_name>"

Enter the custom or predefined service that defines the port number on which the virtual server receives HTTP traffic. The maximum length is 63 characters.

To display the list of existing services, enter:

edit ?

Available only when the operating mode is Reverse Proxy.

sessioncookie-enforce {enable | disable}

• enable—When FortiWeb maintains session persistence using cookies, it inserts a cookie in subsequent transactions in a session if the transaction does not contain a control cookie.

This option is useful if your environment uses TCP multiplexing, which combines HTTP requests from multiple clients in a single session for load balancing or other purposes.

• disable—When FortiWeb maintains session persistence using cookies, it tracks or inserts the cookie for the first transaction of a session only. It does not track or insert a cookie in subsequent transactions in the session, even if the transaction does not contain a control cookie.

For details about configuring session persistence, see server-policy persistence-policy.

sni {enable | disable}

Enable to use a Server Name Indication (SNI) configuration instead of or in addition to the server certificate specified by certificate <certificate_name>.

The SNI configuration enables FortiWeb to determine which certificate to present on behalf of the members of a pool based on the domain in the client request. For details, see system certificate sni.

If you specify both a SNI configuration and a certificate, FortiWeb uses the certificate specified by certificate "<certificate_name>" when the requested domain does not match a value in the SNI configuration.

If you enable sni-strict {enable | disable}, FortiWeb always ignores the value of certificate "<certificate_name>".

Available only if https-service "<service_name>" is configured.

sni-certificate "<sni_name>"

Enter the name of the Server Name Indication (SNI) configuration that specifies which certificate FortiWeb uses when encrypting or decrypting SSL-secured connections for a specified domain.

The SNI configuration enables FortiWeb to present different certificates on behalf of the members of a pool according to the requested domain.

If only one certificate is required to encrypt and decrypt traffic that this policy applies to, specify certificate "<certificate_name>" instead.

Available only if https-service "<service_name>" is configured.

sni-strict {enable | disable}

ssl {enable | disable}

Enable so that connections between clients and FortiWeb use SSL/TLS. Enabling ssl will allow you to configure additional SSL options and settings, including specifying supported SSL protocols and uploading certificates.

ssl-cipher {medium | high | custom}

Specify whether the set of cipher suites that FortiWeb allows creates a medium-security, high-security, or custom configuration.

If custom, also specify ssl-custom-cipher.

This is not allowed to set to custom if http2 is set to enable.

For details, see the FortiWeb Administration Guide:

http://docs.fortinet.com/fortiweb/admin-guides

Available only if https-service "<service_name>" is configured.

ssl-client-verify "<verifier_name>"

Enter the name of a certificate verifier, if any, to use when an HTTP client presents their personal certificate. If you do not select one, the client is not required to present a personal certificate.

If the client presents an invalid certificate, the FortiWeb appliance does not allow the connection.

To be valid, a client certificate must:

• Not be expired
• Not be revoked by either the certificate revocation list (CRL) (see system certificate verify)
• Be signed by a certificate authority (CA) whose certificate you have imported into the FortiWeb appliance; if the certificate has been signed by a chain of intermediate CAs, those certificates must be included in an intermediate CA group (see intermediate-certificate-group "<CA-group_name>")
• Contain a CA field whose value matches the CA certificate
• Contain an Issuer field whose value matches the Subject field in the CA certificate

Personal certificates, sometimes also called user certificates, establish the identity of the person connecting to the website.

You can require that clients present a certificate alternatively or in addition to HTTP authentication. For details, see the FortiWeb Administration Guide:

http://docs.fortinet.com/fortiweb/admin-guides

The maximum length is 63 characters.

To display the list of existing verifiers, type:

edit ?

This option is used only if https-service "<service_name>" is configured.

The client must support TLS 1.0, TLS 1.1, or TLS 1.2.

ssl-custom-cipher {<cipher_1> <cipher2> <cipher3> ...}

Specify one or more cipher suites that FortiWeb allows.

Separate the name of each cipher with a space. To remove from or add to the list of ciphers, retype the entire list.

Valid values are:

ECDHE-ECDSA-AES256-GCM-SHA384

ECDHE-RSA-AES256-GCM-SHA384

DHE-DSS-AES256-GCM-SHA384

DHE-RSA-AES256-GCM-SHA384

ECDHE-ECDSA-CHACHA20-POLY1305

ECDHE-RSA-CHACHA20-POLY1305

DHE-RSA-CHACHA20-POLY1305

ECDHE-ECDSA-AES256-CCM8

ECDHE-ECDSA-AES256-CCM

DHE-RSA-AES256-CCM8

DHE-RSA-AES256-CCM

ECDHE-ECDSA-AES128-GCM-SHA256

ECDHE-RSA-AES128-GCM-SHA256

DHE-DSS-AES128-GCM-SHA256

DHE-RSA-AES128-GCM-SHA256

ECDHE-ECDSA-AES128-CCM8

ECDHE-ECDSA-AES128-CCM

DHE-RSA-AES128-CCM8

DHE-RSA-AES128-CCM

ECDHE-ECDSA-AES256-SHA384

ECDHE-RSA-AES256-SHA384

DHE-RSA-AES256-SHA256

DHE-DSS-AES256-SHA256

ECDHE-ECDSA-CAMELLIA256-SHA384

ECDHE-RSA-CAMELLIA256-SHA384

DHE-RSA-CAMELLIA256-SHA256

DHE-DSS-CAMELLIA256-SHA256

ECDHE-ECDSA-AES128-SHA256

ECDHE-RSA-AES128-SHA256

DHE-RSA-AES128-SHA256

DHE-DSS-AES128-SHA256

ECDHE-ECDSA-CAMELLIA128-SHA256

ECDHE-RSA-CAMELLIA128-SHA256

DHE-RSA-CAMELLIA128-SHA256

DHE-DSS-CAMELLIA128-SHA256

ECDHE-ECDSA-AES256-SHA

ECDHE-RSA-AES256-SHA

DHE-RSA-AES256-SHA

DHE-DSS-AES256-SHA

DHE-RSA-CAMELLIA256-SHA

DHE-DSS-CAMELLIA256-SHA

ECDHE-ECDSA-AES128-SHA

ECDHE-RSA-AES128-SHA

DHE-RSA-AES128-SHA

DHE-DSS-AES128-SHA

DHE-RSA-CAMELLIA128-SHA

DHE-DSS-CAMELLIA128-SHA

AES256-GCM-SHA384

AES256-CCM8

AES256-CCM

AES128-GCM-SHA256

AES128-CCM8

AES128-CCM

AES256-SHA256

CAMELLIA256-SHA256

AES128-SHA256

CAMELLIA128-SHA256

AES256-SHA

CAMELLIA256-SHA

AES128-SHA

CAMELLIA128-SHA

DHE-RSA-SEED-SHA

ECDHE_RSA_DES_CBC3_SHA

DES_CBC3_SHA

tls13-custom-cipher {<cipher_1> <cipher2> <cipher3> ...}

Specify one or more TLS 1.3 cipher suites that FortiWeb allows.

Separate the name of each cipher with a space. To remove from or add to the list of ciphers, retype the entire list.

Valid values are:

TLS_AES_256_GCM_SHA384

TLS_CHACHA20_POLY1305_SHA256

TLS_AES_128_GCM_SHA256

TLS_AES_128_CCM_SHA256

TLS_AES_128_CCM_8_SHA256

ssl-noreg {enable | disable}

Specify whether FortiWeb ignores requests from clients to renegotiate TLS or SSL.

Protects against denial-of-service (DoS) attacks that use TLS/SSL renegotiation to overburden the server.

Available only if https-service "<service_name>" is configured.

status {enable | disable}

Enable to allow the policy to be used when evaluating traffic for a matching policy.

Note: You can use SNMP traps to notify you of changes to the policy’s status. For details, see system snmp community.

syncookie {enable | disable}

Enable to detect TCP SYN flood attacks.

For details, see the FortiWeb Administration Guide:

http://docs.fortinet.com/fortiweb/admin-guides

Available only when the operating mode is Reverse Proxy or True Transparent Proxy.

tcp-recv-timeout <seconds_int>

Enter the amount of time (in seconds) that FortiWeb will wait for a client to send a request after the client sets up a TCP connection. The valid range is 0–300. A value of 0 means that there is no timeout.

tls-v10 {enable | disable}

Specifies whether clients can connect securely to FortiWeb using the TLS 1.0 cryptographic protocol.

This must be set to disable if http2 {enable | disable} is set to enable.

Available only if https-service "<service_name>" is configured.

tls-v11 {enable | disable}

Specifies whether clients can connect securely to FortiWeb using the TLS 1.1 cryptographic protocol.

This must be set to disable if http2 {enable | disable} is set to enable.

Available only if https-service "<service_name>" is configured.

tls-v12 {enable | disable}

Specifies whether clients can connect securely to FortiWeb using the TLS 1.2 cryptographic protocol.

Available only if https-service "<service_name>" is configured.

tls-v13 {enable | disable}

Specifies whether clients can connect securely to FortiWeb using the TLS 1.3 cryptographic protocol.

Available only if https-service "<service_name>" is configured.

urlcert {enable | disable}

Specifies whether FortiWeb uses a URL-based client certificate group to determine whether a client is required to present a personal certificate.

Available only if https-service "<service_name>" is configured.

urlcert-group "<urlcert-group_name>"

Enter the URL-based client certificate group that determines whether a client is required to present a personal certificate.

If the URL the client requests does not match an entry in the group, the client is not required to present a personal certificate.

For details about creating a group, see system certificate urlcert.

urlcert-hlen <len_int>

Specify the maximum allowed length for an HTTP request with a URL that matches an entry in the URL-based client certificate group, in kilobytes.

FortiWeb blocks any matching requests that exceed the specified size.

This setting prevents a request from exceeding the maximum buffer size.

The valid range is 16–10240.

vserver "<vserver_name>"

Enter the name of a virtual server that provides the IP address and network interface of incoming traffic that FortiWeb routes and to which the policy applies a protection profile. The maximum length is 63 characters.

To display the list of existing virtual servers, enter:

edit ?

Available only if the operating mode is Reverse Proxy.

v-zone "<bridge_name>"

Enter the name of the bridge that specifies the network interface of the incoming traffic that the policy applies a protection profile to. The maximum length is 15 characters.

To display the list of existing bridges, enter:

edit ?

Available only if the operating mode is True Transparent Proxy or Transparent Inspection.

Note: If the connection fails when you have selected a certificate verifier, verify that the certificate meets the web browser’s requirements. Web browsers may have their own certificate validation requirements in addition to FortiWeb requirements. For example, personal certificates for client authentication may be required to either:

• Not be restricted in usage/purpose by the CA, or
• Contain a Key Usage field that contains Digital Signature or have a ExtendedKeyUsage or EnhancedKeyUsage field whose value contains Client Authentication

If the certificate does not satisfy browser requirements, although it may be installed in the browser, when the FortiWeb appliance requests the client’s certificate, the browser may not display a certificate selection dialog to the user, or the dialog may not contain that certificate. In that case, verification fails. For browser requirements, see your web browser’s documentation.

<entry_index>

content-routing-policy-name "<content-routing_name>"

Enter the name of a HTTP content routing policy that this server policy uses.

To display the list of existing error pages, enter:

edit ?

is-default {yes | no}

profile-inherit {enable | disable}