"<ip-list_name>"

Enter the name of a new or existing rule. The maximum length is 63 characters.

To display the list of existing rules, enter:

edit ?

action { alert_deny | block-period | deny_no_log}

Select which action FortiWeb will take when it detects a violation of the rule:

• alert_deny—Block the request (or reset the connection) and generate an alert and/or log message.

• deny_no_log—Block the request (or reset the connection).

• block-period—Block subsequent requests from the client for a number of seconds. Also configure block-period.

Note: This setting will be ignored if monitor-mode {enable | disable} is enabled in a server policy.

block-period <block_period_int>

Enter the number of seconds that you want to block subsequent requests from a client after FortiWeb detects that the client has violated the rule. The valid range is 1–3,600 seconds.

This setting is available only if Action is set to block-period.

severity {Low | Medium | High | Info}

When rule violations are recorded in the attack log, each log message contains a Severity Level (severity_level) field. Select which severity level the FortiWeb appliance will use when a blacklisted IP address attempts to connect to your web servers:

• Low
• Medium
• High
• info

trigger-policy "<trigger-policy_name>"

Select which trigger, if any, that the FortiWeb appliance will use when it logs and/or sends an alert email about a blacklisted IP address’s attempt to connect to your web servers. The maximum length is 63 characters. For details, see log trigger-policy.

To display the list of existing trigger policies, enter:

set trigger ?

ignore-x-forwarded-for {enable | disable}

By default, FortiWeb scans the IP addresses in the X-Forwarded-For header at the HTTP layer. This causes high resource consumption. To enhance the performance, you can enable Ignore X-Forwarded-For so that the IP addresses can be scanned at the TCP layer instead. This avoids HTTP packets being processed unnecessarily.

<entry_index>

ip "<client_ip>"

Enter one of the following values:

• A single IP address that a client source IP must match, such as a trusted private network IP address (e.g. an administrator’s computer, 172.16.1.20).
• A range or addresses (for example, 172.22.14.1-172.22.14.256 or 10:200::10:1-10:200:10:100).