Creating OpenAPI validation policies
This section provides instructions to:
- Create an OpenAPI validation policy
- Apply an OpenAPI validation policy in a web protection profile
To create an OpenAPI validation policy
- Go to Web Protection > OpenAPI Validation > OpenAPI Validation Policy.
- Click Create New.
- Configure these settings:
-
Name Type a name that can be referenced by other parts of the configuration. Do not use spaces or special characters. Select which action FortiWeb will take when it detects a violation of the policy:
-
Alert—Accept the connection and generate an alert email and/or log message.
-
Alert & Deny—Block the request (or reset the connection) and generate an alert and/or log message.
-
Deny (no log)—Block the request (or reset the connection).
-
Period Block—Block subsequent requests from the client for a number of seconds. Also configure Block Period.
-
Redirect—Redirect the request to the URL that you specify in the protection profile and generate an alert and/or log message.
-
Send 403 Forbidden—Reply with an HTTP
403 Access Forbiddenerror message and generate an alert and/or log message.
The default value is Alert.
Note: Logging and/or alert email will occur only if enabled and configured. For details, see Logging and Alert email.
Block Period Enter the number of seconds that you want to block subsequent requests from a client after FortiWeb detects that the client has violated the policy. The valid range is 1–3,600. The default value is 60.
This setting is available only if Action is set to Period Block.Severity
When policy violations are recorded in the attack log, each log message contains a Severity Level (
severity_level) field. Select which severity level FortiWeb will use when it logs a violation of the policy:- Informative
- Low
- Medium
- High
The default value is Low.
Trigger Policy Select the trigger, if any, that FortiWeb will use when it logs and/or sends an alert email about a violation of the policy. For details, see Viewing log messages. -
- Click OK.
- To add OpenAPI files to the policy, see To add an OpenAPI file to an OpenAPI validation policy.
To apply an OpenAPI validation policy in a web protection profile
For details about creating a web protection profile, see Configuring a protection profile for inline topologies.
- Go to Policy > Server Policy.
- Select an existing web protection profile to which you want to include the OpenAPI validation policy.
- Click Edit.
- Go to Security Configuration > Web Protection Profile.
- Click
to enter the Edit Inline Protection Profile page. - For OpenAPI Validation, select the OpenAPI policy from the drop down list.
You can also clickto open the Edit OpenAPI Validation Policy page.
- Click OK.
To view the OpenAPI validation related logs
- Go to Log&Report > Log Config > Other Log Settings.
- From Retain Packet Payload For, enable OpenAPI Validation.
- Go to Log&Report > Log Access > Attack.
- Click one attack log. From the right bottom, you can see the log information.
