Fortinet white logo
Fortinet docs logo DOCUMENT LIBRARY
Fortinet white logo
Fortinet docs logo DOCUMENT LIBRARY
Products Best Practices Hardware Guides Products A-Z
Summary
By Solution
By 4D Pillars
By Cloud
Secure Networking
Unified SASE
Security Operations
Secure SD-WAN
Secure Access Service Edge (SASE)
ZTNA
LAN Edge
Identity and Access Management
Next Generation Firewall
Public Cloud
Private Cloud
FortiCloud
Secure Networking
  • Hybrid Mesh Firewall
  • NOC Management
  • LAN
  • WAN
    • More >>
    Unified SASE
  • Single Vendor SASE
  • Cloud Network Security
  • Secure Endpoint Connectivity
  • Web Application / API Protection
    • More >>
    Security Operations
  • Security Operations Automation
  • Identity
  • Early Detection & Prevention
    • More >>
    Secure Networking
  • Hybrid Mesh Firewall
  • NOC Management
  • LAN
  • WAN
  • Communication & Surveillance
    • Unified SASE
  • Single Vendor SASE
  • Secure Endpoint Connectivity
  • Cloud Network Security
  • Cloud-Native Security
  • Web Application / API Protection
    • Security Operations
  • Security Operations Automation
  • Endpoint
  • Data Protection
  • Identity
  • Email
  • Early Detection & Prevention
  • Expert Services
  • Edge Firewall
  • Orchestration & management
  • SD Branch
  • Application Delivery
  • Single Vendor SASE
  • Secure Endpoint Connectivity
  • Secure Private Access
  • Thin Edge
  • Identity
  • Application Gateway
  • Enterprise Asset Management
  • Endpoint Agent
  • Agentless Security Posture
  • Identity
  • Wireless
  • Switching
  • Identity
  • Privilege Acccess Management
  • Next Generation Firewall
  • Orchestration & management
  • Expert Services
  • All
  • All
  • Account Management
  • SAAS Management
  • SAAS Application Security
  • Managed Services
  • Platform as a service (PAAS)
  • Other SAAS Services
    • 4D Resources
    Solution Hubs
  • 4D Pillars
  • Cloud
  • Popular Solutions

    • CLI Reference

    Home FortiWeb 6.3.0 CLI Reference
    6.3.0
    7.6.1
    7.6.0
    7.4.5
    7.4.4
    7.4.3
    7.4.2
    7.4.1
    7.4.0
    7.2.10
    7.2.9
    7.2.8
    7.2.7
    7.2.6
    7.2.4
    7.2.3
    7.2.2
    7.2.1
    7.2.0
    7.0.9
    7.0.8
    7.0.7
    7.0.6
    7.0.4
    7.0.3
    7.0.2
    7.0.1
    7.0.0
    6.4.3
    6.4.2
    6.4.1
    6.4.0
    6.3.23
    6.3.19
    6.3.18
    6.3.17
    6.3.16
    6.3.15
    6.3.14
    6.3.13
    6.3.11
    6.3.10
    6.3.9
    6.3.7
    6.3.6
    6.3.5
    6.3.4
    6.3.3
    6.3.2
    6.3.1
    6.3.0
    6.2.6
    6.2.5
    6.2.4
    6.2.3
    6.2.2
    6.2.1
    6.2.0
    6.1.2
    6.1.1
    5.7.0
    5.6.1
    5.6.0

    What’s new

    What’s new

    The tables below list commands newly added for FortiWeb 6.3.0.

    Command Change
    backup full-config-with-ML-data

    execute backup full-config-with-ML-data

    		 Use this command to back up full configurations with machine learning data.
    debug proxy log
    diagnose debug proxy log {1 | 2 |3} Use this command to print the logs generated by proxyd.
    system firewall fwmark-policy

    config system firewall fwmark-policy

    edit "<fwmark-policy-name>"

    set from <firewall_source-address_name>

    set to <firewall_destination-address_name>

    set in-interface <incoming_interface_name>

    set service <firewall-service_name>"

    set mark <mark_int>

    end

    		 New command.
    router policy

    config router policy

    edit <policy_index>

    set action {forward-traffic | stop-policy-routing}

    set fwmark <fwmark_int>

    next

    end

    		 New commands.
    system firewall dnat policy

    config system firewall dnat-policy

    edit "<policy_name>"

    set external-start <external_ipv4>

    set mapped-start <mapped_ipv4>

    set mapped-end <mapped_ipv4>

    set ingress-interface <ingress_port>

    set protocol {tcp | udp | icmp}

    set port-forwarding {enable | disable}

    set external-port-start <external_port>

    set external-port-end <external_port>

    set mapped-port-start <mapped_port>

    set mapped-port-end <mapped_port>

    next

    end

    		 New commands.
    system firewall snat-policy

    config system firewall snat-policy

    edit "<policy_name>"

    set source-start <source_ipv4>

    set source-end <source_ipv4>

    set destination-start <destination_ipv4>

    set destination-end <destination_ipv4>

    set trans-to-type {ip | pool | no-nat}

    next

    end

    		 New commands.
    server-policy setting

    config server-policy setting

    set using-dns-proxy {enable | disable}

    end

    Enable to use getaddrinfo to resolve the domain name.
    system global

    config system global

    set fortiguard-anycast {enable | disable}

    set ipv6-dad-ha {enable | disable}

    end

    		New commands.
    system network-option

    config system network-option

    set ipfrag-high-thresh <ipfrag-high-thresh_int>

    set ipfrag-low-thresh <ipfrag-low-thresh_int>

    set ipfrag-timeout <ipfrag-timeout_int>

    set ip6frag-high-thresh <ip6frag-high-thresh_int>

    set ip6frag-low-thresh <ip6frag-low-thresh_int>

    set ip6frag-timeout <ip6frag-timeout_int>

    end

    		 Configure the IP fragmentation protection feature.

    system feature-visibility

    config system feature-visibility

    set acceleration-policy {enable | disable}

    set web-cache {enable | disable}

    end

    		 Add acceleration and web cache switch on/off.

    server-policy setting

    config server-policy setting

    set df-flag {enable | disable}

    end

    		Enable to allow FortiWeb to send non DF-flag packet to pass the device with low MTU.
    waf user-tracking rule

    config waf user-tracking rule

    edit <rule_name>

    set hostname-ip "<hostname-ip_str>"

    set host-status { enable | disable}

    set limit-users {enable | disable}

    set maximum-users <maximum-users_int>

    set session-idle-timeout <session-idle-timeout_int>

    set session-timeout-enable {enable | disable}

    next

    end

    		 You can now configure FortiWeb to limit the concurrent number of users accessing the same account in User Tracking
    waf file-upload-restriction-rule

    config waf file-upload-restriction-rule

    edit "<file-upload-restriction-rule_name>"

    set host-status {enable | disable}

    set host "<protected-host_name>"

    set request-file "<url_pattern>"

    set request-type {regular | plain}

    set file-uncompress {enable | disable}

    next

    end

    		 Enable file unzip in CLI to verify file type and size in the compressed files.
    waf x-forwarded-for

    config waf x-forwarded-for

    edit "<x-forwarded-for_name>"

    set x-forwarded-for-support {enable | disable}

    set add-source-port {enable | disable}

    set x-forwarded-port {enable | disable}

    next

    end

    		 Configure to add the X-Forwarded-Port and Source Port in X-Forwarded-For Rule to record the source IP of TCP connection.
    waf application-layer-dos-prevention

    config waf application-layer-dos-prevention

    edit "<app-dos-policy_name>"

    set enable-http-session-based-prevention {enable | disable}

    set layer3-fragment-protection {enable | disable}

    next

    end

    		 Enable to prevent attacks of fragmented packets.
    waf web-protection-profile inline-protection

    config waf web-protection-profile inline-protection

    edit "<inline-protection-profile_name>"

    set url-encryption-policy <url-encryption-policy_str>

    next

    end

    		 Select the URL encryption policy name.
    server-policy server-pool

    config server-policy server-pool

    edit <server-pool_name>

    set adfs-server-name <adfs-server-name_str>

    next

    end

    		 Enter the ADFS server name.

    server-policy http-content-routing-policy

    set ip-list <ip-list_str>

    		 Add these two fields to configur multiple IPs or IP range.
    server-policy policy

    config server-policy policy

    edit <policy_name>

    set acceleration-policy <acceleration-policy_str>

    set web-cache {enable | disable}

    set real-ip-addr <real-ip-addr_str>

    set retry-on {enable | disable}

    set retry-on-cache-size <retry-on-cache-size_int>

    set retry-on-connect-failure {enable | disable}

    set retry-times-on-connect-failure <retry-times-on-connect-failure_int>

    set retry-on-http-layer {enable | disable}

    set retry-times-on-http-layer <retry-times-on-http-layer_int>

    set retry-on-http-response-codes {404 | 408 | 500 | 501 | 502 | 503 | 504}

    next

    end

    		 Add acceleration policy, web cache, and retry on related commands.

    server-policy acceleration

    config server-policy acceleration exception

    edit "<exception_name>"

    config list

    edit "<exception-item_id>"

    set host-status {enable | disable}

    set host <host_int>

    set url-type {plain | regular}

    set url-pattern <url-pattern_str>

    next

    end

    next

    end

    config server-policy acceleration policy

    edit "<policy_name>"

    set exception <exception_str>

    set html-minify {enable | disable}

    set html-combine-heads {enable | disable}

    set html-css2head {enable | disable}

    set js-minify {enable | disable}

    set css-minify {enable | disable}

    next

    end

    		 Configure the acceleration module to speed up web application response and optimize web pages and resources in real time.
    waf web-cache

    config waf web-cache-rule

    edit "<web-cache-rule_name>"

    set host-status {enable | disable}

    set host <host_str>

    set path <path_str>

    set http-method {get-head | get-head-options | all-methods}

    set request-file-type {text | picture | media | binary | other}

    set allow-return-code {allow-200 | allow-200-206 | allow-200-206-301-302}

    set cache-inactive-time <cache-inactive-time_int>

    set inactive-time-type {minutes | hours}

    set client-cache-expire <client-cache-expire_int>

    set client-cache-expire-type {minutes | hours}

    set key-factor {method | protocol | host | url | arguments | cookies}

    set enable-client-expire {enable | disable}

    set policy-id <entry_index>

    config cookie-name-list

    edit <cookie-name-list_name>

    set cookie-name "<cookie-name_str>"

    end

    config bypass-sub-url

    edit <bypass-sub-url_id>

    set http-method {get | post | head | options | trace | connect | delete | put | patch | any}

    set type {plain | regular}

    set url-expression <url-expression_str>

    set enable-bypass-args {enable | disable}

    set bypass-args <bypass-args_str>

    set enable-bypass-cookies {enable | disable}

    set bypass-cookies <bypass-cookies_str>

    end

    next

    end

    config waf web-cache-policy

    edit "<web-cache-policy_name>"

    next

    end

    		 Configure web cache rules and policies.
    waf url-encryption

    config waf url-encryption url-encryption-rule

    edit "<encryption-rule_name>"

    set host-status {enable | disable}

    set host <host_str>

    set allow-unencrypted {enable | disable}

    set action {alert | deny_no_log | alert_deny | block-period}

    set block-period <block-period_int>

    set severity {High | Medium | Low | Info}

    set trigger <trigger_str>

    config url-list

    edit "<url-list_id>"

    set url-type {plain | regular}

    set url-pattern <url-pattern_str>

    end

    config exceptions

    edit "<exceptions-item_id>"

    set url-type {plain | regular}

    set url-pattern <url-pattern_str>

    end

    next

    end

    config waf url-encryption url-encryption-policy

    edit "<url-encryption-policy_name>"

    set full-mode {enable | disable}

    config rule-list

    edit "<rule-list_id>"

    set rule <rule_str>

    end

    next

    end

    		 Configure the URL encryption rules and policies.
    Previous
    Next

    What’s new

    What’s new

    The tables below list commands newly added for FortiWeb 6.3.0.

    Command Change
    backup full-config-with-ML-data

    execute backup full-config-with-ML-data

    		 Use this command to back up full configurations with machine learning data.
    debug proxy log
    diagnose debug proxy log {1 | 2 |3} Use this command to print the logs generated by proxyd.
    system firewall fwmark-policy

    config system firewall fwmark-policy

    edit "<fwmark-policy-name>"

    set from <firewall_source-address_name>

    set to <firewall_destination-address_name>

    set in-interface <incoming_interface_name>

    set service <firewall-service_name>"

    set mark <mark_int>

    end

    		 New command.
    router policy

    config router policy

    edit <policy_index>

    set action {forward-traffic | stop-policy-routing}

    set fwmark <fwmark_int>

    next

    end

    		 New commands.
    system firewall dnat policy

    config system firewall dnat-policy

    edit "<policy_name>"

    set external-start <external_ipv4>

    set mapped-start <mapped_ipv4>

    set mapped-end <mapped_ipv4>

    set ingress-interface <ingress_port>

    set protocol {tcp | udp | icmp}

    set port-forwarding {enable | disable}

    set external-port-start <external_port>

    set external-port-end <external_port>

    set mapped-port-start <mapped_port>

    set mapped-port-end <mapped_port>

    next

    end

    		 New commands.
    system firewall snat-policy

    config system firewall snat-policy

    edit "<policy_name>"

    set source-start <source_ipv4>

    set source-end <source_ipv4>

    set destination-start <destination_ipv4>

    set destination-end <destination_ipv4>

    set trans-to-type {ip | pool | no-nat}

    next

    end

    		 New commands.
    server-policy setting

    config server-policy setting

    set using-dns-proxy {enable | disable}

    end

    Enable to use getaddrinfo to resolve the domain name.
    system global

    config system global

    set fortiguard-anycast {enable | disable}

    set ipv6-dad-ha {enable | disable}

    end

    		New commands.
    system network-option

    config system network-option

    set ipfrag-high-thresh <ipfrag-high-thresh_int>

    set ipfrag-low-thresh <ipfrag-low-thresh_int>

    set ipfrag-timeout <ipfrag-timeout_int>

    set ip6frag-high-thresh <ip6frag-high-thresh_int>

    set ip6frag-low-thresh <ip6frag-low-thresh_int>

    set ip6frag-timeout <ip6frag-timeout_int>

    end

    		 Configure the IP fragmentation protection feature.

    system feature-visibility

    config system feature-visibility

    set acceleration-policy {enable | disable}

    set web-cache {enable | disable}

    end

    		 Add acceleration and web cache switch on/off.

    server-policy setting

    config server-policy setting

    set df-flag {enable | disable}

    end

    		Enable to allow FortiWeb to send non DF-flag packet to pass the device with low MTU.
    waf user-tracking rule

    config waf user-tracking rule

    edit <rule_name>

    set hostname-ip "<hostname-ip_str>"

    set host-status { enable | disable}

    set limit-users {enable | disable}

    set maximum-users <maximum-users_int>

    set session-idle-timeout <session-idle-timeout_int>

    set session-timeout-enable {enable | disable}

    next

    end

    		 You can now configure FortiWeb to limit the concurrent number of users accessing the same account in User Tracking
    waf file-upload-restriction-rule

    config waf file-upload-restriction-rule

    edit "<file-upload-restriction-rule_name>"

    set host-status {enable | disable}

    set host "<protected-host_name>"

    set request-file "<url_pattern>"

    set request-type {regular | plain}

    set file-uncompress {enable | disable}

    next

    end

    		 Enable file unzip in CLI to verify file type and size in the compressed files.
    waf x-forwarded-for

    config waf x-forwarded-for

    edit "<x-forwarded-for_name>"

    set x-forwarded-for-support {enable | disable}

    set add-source-port {enable | disable}

    set x-forwarded-port {enable | disable}

    next

    end

    		 Configure to add the X-Forwarded-Port and Source Port in X-Forwarded-For Rule to record the source IP of TCP connection.
    waf application-layer-dos-prevention

    config waf application-layer-dos-prevention

    edit "<app-dos-policy_name>"

    set enable-http-session-based-prevention {enable | disable}

    set layer3-fragment-protection {enable | disable}

    next

    end

    		 Enable to prevent attacks of fragmented packets.
    waf web-protection-profile inline-protection

    config waf web-protection-profile inline-protection

    edit "<inline-protection-profile_name>"

    set url-encryption-policy <url-encryption-policy_str>

    next

    end

    		 Select the URL encryption policy name.
    server-policy server-pool

    config server-policy server-pool

    edit <server-pool_name>

    set adfs-server-name <adfs-server-name_str>

    next

    end

    		 Enter the ADFS server name.

    server-policy http-content-routing-policy

    set ip-list <ip-list_str>

    		 Add these two fields to configur multiple IPs or IP range.
    server-policy policy

    config server-policy policy

    edit <policy_name>

    set acceleration-policy <acceleration-policy_str>

    set web-cache {enable | disable}

    set real-ip-addr <real-ip-addr_str>

    set retry-on {enable | disable}

    set retry-on-cache-size <retry-on-cache-size_int>

    set retry-on-connect-failure {enable | disable}

    set retry-times-on-connect-failure <retry-times-on-connect-failure_int>

    set retry-on-http-layer {enable | disable}

    set retry-times-on-http-layer <retry-times-on-http-layer_int>

    set retry-on-http-response-codes {404 | 408 | 500 | 501 | 502 | 503 | 504}

    next

    end

    		 Add acceleration policy, web cache, and retry on related commands.

    server-policy acceleration

    config server-policy acceleration exception

    edit "<exception_name>"

    config list

    edit "<exception-item_id>"

    set host-status {enable | disable}

    set host <host_int>

    set url-type {plain | regular}

    set url-pattern <url-pattern_str>

    next

    end

    next

    end

    config server-policy acceleration policy

    edit "<policy_name>"

    set exception <exception_str>

    set html-minify {enable | disable}

    set html-combine-heads {enable | disable}

    set html-css2head {enable | disable}

    set js-minify {enable | disable}

    set css-minify {enable | disable}

    next

    end

    		 Configure the acceleration module to speed up web application response and optimize web pages and resources in real time.
    waf web-cache

    config waf web-cache-rule

    edit "<web-cache-rule_name>"

    set host-status {enable | disable}

    set host <host_str>

    set path <path_str>

    set http-method {get-head | get-head-options | all-methods}

    set request-file-type {text | picture | media | binary | other}

    set allow-return-code {allow-200 | allow-200-206 | allow-200-206-301-302}

    set cache-inactive-time <cache-inactive-time_int>

    set inactive-time-type {minutes | hours}

    set client-cache-expire <client-cache-expire_int>

    set client-cache-expire-type {minutes | hours}

    set key-factor {method | protocol | host | url | arguments | cookies}

    set enable-client-expire {enable | disable}

    set policy-id <entry_index>

    config cookie-name-list

    edit <cookie-name-list_name>

    set cookie-name "<cookie-name_str>"

    end

    config bypass-sub-url

    edit <bypass-sub-url_id>

    set http-method {get | post | head | options | trace | connect | delete | put | patch | any}

    set type {plain | regular}

    set url-expression <url-expression_str>

    set enable-bypass-args {enable | disable}

    set bypass-args <bypass-args_str>

    set enable-bypass-cookies {enable | disable}

    set bypass-cookies <bypass-cookies_str>

    end

    next

    end

    config waf web-cache-policy

    edit "<web-cache-policy_name>"

    next

    end

    		 Configure web cache rules and policies.
    waf url-encryption

    config waf url-encryption url-encryption-rule

    edit "<encryption-rule_name>"

    set host-status {enable | disable}

    set host <host_str>

    set allow-unencrypted {enable | disable}

    set action {alert | deny_no_log | alert_deny | block-period}

    set block-period <block-period_int>

    set severity {High | Medium | Low | Info}

    set trigger <trigger_str>

    config url-list

    edit "<url-list_id>"

    set url-type {plain | regular}

    set url-pattern <url-pattern_str>

    end

    config exceptions

    edit "<exceptions-item_id>"

    set url-type {plain | regular}

    set url-pattern <url-pattern_str>

    end

    next

    end

    config waf url-encryption url-encryption-policy

    edit "<url-encryption-policy_name>"

    set full-mode {enable | disable}

    config rule-list

    edit "<rule-list_id>"

    set rule <rule_str>

    end

    next

    end

    		 Configure the URL encryption rules and policies.
    Previous
    Next