Administration Guide

Introduction
What's new
Key concepts
- Workflow
- Sequence of scans
- IPv6 support
- Solutions for specific web attacks
- HTTP/2 support
- HTTP sessions & security
- FortiWeb high availability (HA)
- Administrative domains (ADOMs)
- How to use the web UI
- Shutdown
How to set up your FortiWeb
- Appliance vs. VMware
- Registering your FortiWeb
- Planning the network topology
- Connecting to the web UI or CLI
- Updating the firmware
- Changing the “admin” account password
- Setting the system time & date
- Setting the operation mode
- Configuring High Availability (HA) basic settings
  - HA heartbeat & active node election
  - Synchronization
- Replicating the configuration without FortiWeb HA (external HA)
- Configuring the network settings
- Configuring DNS settings
- Configuring HA settings specifically for active-passive and standard active-active modes
- Configuring HA settings specifically for high volume active-active mode
- Defining your web servers & load balancers
- Configuring FortiWeb to receive traffic via WCCP
- Configuring basic policies
- Testing your installation
- Switching out of Offline Protection mode
Policies
- How operation mode affects server policy behavior
- Configuring the global object white list
- Configuring a protection profile for inline topologies
- Generating a protection profile using scanner reports
- Configuring a protection profile for an out-of-band topology or asynchronous mode of operation
- Configuring client management
- Configuring an HTTP server policy
- Configuring traffic mirror
Configuring FTP security
- Creating an FTP command restriction rule
- Creating an FTP file check rule
- Configuring an FTP security inline profile
- Creating an FTP server pool
- Creating an FTP server policy
ADFS Proxy
- Configuring FortiWeb as an ADFS proxy
- Configuring a virtual server
- Creating an ADFS server pool
- Uploading trusted CA certificates
- Creating an ADFS server policy
- Troubleshooting
FortiView
- Topology
- Security
- Traffic
- Sessions
Backups
- Restoring a previous configuration
Debug log
Administrators
- Configuring access profiles
- Grouping remote authentication queries and certificates for administrators
- Changing an administrator’s password
- Certificate-based Web UI login
Users
- Authentication styles
- Offloading HTTP authentication & authorization
- Single sign-on (SSO) (site publishing)
- Using Kerberos authentication delegation
- Offloaded authentication and optional SSO configuration
- To create an Active Directory (AD) user for FortiWeb
- Example: Enforcing complex passwords
- Tracking users
Secure connections (SSL/TLS)
- Offloading vs. inspection
- Supported cipher suites & protocol versions
- Uploading trusted CA certificates
- How to offload or inspect HTTPS
- Forcing clients to use HTTPS
- HTTP Public Key Pinning
- How to apply PKI client authentication (personal certificates)
- Seamless PKI integration
- Revoking certificates
- How to export/back up certificates & private keys
- How to change FortiWeb's default certificate
- Configuring OCSP stapling
Access control
- Restricting access to specific URLs
- Combination access control & rate limiting
- Blacklisting & whitelisting clients
- Protecting against cookie poisoning and other cookie-based attacks
- Cross-Origin Resource Sharing (CORS) protection
- URL encryption
Blocking known attacks & data leaks
- Connecting to FortiGuard services
- Receiving quarantined source IP addresses from FortiGate
- False Positive Mitigation for SQL Injection signatures
- Syntax-based SQL/XSS injection detection
- Configuring action overrides or exceptions to data leak & attack detection signatures
- Defining custom data leak & attack signatures
- Defeating cipher padding attacks on individually encrypted inputs
- Defeating cross-site request forgery (CSRF) attacks
- Addressing security vulnerabilities by HTTP Security Headers
Preventing zero-day attacks
- Validating parameters (“input rules”)
- Preventing tampering with hidden inputs
  - Specifying allowed HTTP methods
- HTTP/HTTPS protocol constraints
- WebSocket Protocol
Protection for Man-in-the-Browser (MiTB) attacks
- Creating Man in the Browser (MiTB) Protection Rule
- Creating Man in the Browser (MiTB) Protection Policy
Protection for APIs
- Configuring JSON protection
- Configuring XML protection
- OpenAPI Validation
- Configuring mobile API protection
- API gateway
Limiting file uploads
Anti-defacement
Rate limiting
- DoS prevention
- Preventing slow and low attacks
Rewriting & redirecting
Caching
- What can be cached?
Compression
Acceleration
Compliance
- Database security
- Authorization
- Preventing data leaks
- Vulnerability scans
Advanced/optional system settings
- Changing the FortiWeb appliance’s host name
- Fail-to-wire for power loss/reboots
- Customizing error and authentication pages (replacement messages)
- Configuring the integrated firewall
  - Network address translation (NAT)
- Advanced settings
Monitoring your system
- Status dashboard
- Policy Status dashboard
- RAID level & disk statuses
- Logging
- Alert email
- SNMP traps & queries
- Reports
- Monitoring currently blocked IPs
- Monitoring currently tracked clients
- FortiGuard updates
- Vulnerability scans
Bot mitigation
- Configuring threshold based detection
- Configuring biometrics based detection
- Configuring bot deception
- Configuring known bots
- Configuring bot mitigation policy
Machine learning
- Enabling machine learning policy
- Configuring anomaly detection policy
- Configuring bot detection profiles
  - Viewing bot detection model status
  - Viewing the bot detection violations
Fine-tuning & best practices
- Hardening security
- Improving performance
- Improving fault tolerance
- Reducing false positives
- Regular backups
- Downloading logs in RAM before shutdown or reboot
Troubleshooting
- Frequently asked questions
- Tools
- How to troubleshoot
- Solutions by issue type
- Resetting the configuration
- Restoring firmware (“clean install”)
Appendix A: Port numbers
Appendix B: Maximum configuration values
Appendix C: Supported RFCs, W3C, & IEEE standards
Appendix D: Regular expressions
Appendix E: How to purchase and renew FortiGuard licenses

Home FortiWeb 6.3.4 Administration Guide

6.3.4

Appendix B: Maximum configuration values

These tables provide the maximum number of configuration objects for FortiWeb products. They are not a guarantee of performance. For values such as hardware specifications that do not vary by software version or configuration, see your model’s QuickStart Guide.

Due to resource constraints, the maximums for certain objects apply to each appliance globally and you cannot increase them by adding ADOMs. For example, the limit for server policies is a global one that applies to the appliance, you can configure only 256 server policies, regardless of how many ADOMs you use.

While the maximums for other objects apply at the ADOM level only, so you can add objects beyond the maximum by adding ADOMs. For example, for a FortiWeb 1000D, you can configure up to 1024 URL Access polices for each of the 32 possible ADOMs because the limit applies to each ADOM, not the appliance.

Depending on the RAM available, adding the maximum number of objects to multiple ADOMs can have an impact on your FortiWeb's performance. Fortinet recommends that you do not add the maximum number of objects in all ADOMs.

Per appliance configuration maximums - ADOMs, server policies, Virtual IPs, server objects, and domains in ML policies

The configuration maximums for the following items apply at the appliance level, and the maximums vary on each model, as shown in the following table.

FortiWeb model	ADOMs	Server policies	Virtual IPs	Server Objects			Domains in all ML policies
FortiWeb model	ADOMs	Server policies	Virtual IPs	Server pools	Pool members	Virtual servers	Domains in all ML policies
FortiWeb 100D	0	32	1024	256	1024	1024	4
FortiWeb 400C	32	64	1024	256	1024	1024	6
FortiWeb 400D	32	64	1024	256	1024	1024	6
FortiWeb 400E	32	64	1024	256	1024	1024	6
FortiWeb 600D	32	96	1024	384	1024	1024	16
FortiWeb 600E	32	96	1024	384	1024	1024	16
FortiWeb 1000D	64	256	1024	512	1024	1024	32
FortiWeb 1000E	64	256	6000	6000	12000	6000	32
FortiWeb 2000E	64	256	6000	6000	12000	6000	64
FortiWeb 3000C	32	256	1024	256	1024	1024	16
FortiWeb 3000CFsx	32	256	1024	256	1024	1024	16
FortiWeb 3000D	64	512	1024	512	1024	1024	32
FortiWeb 3000DFsx	64	512	1024	512	1024	1024	32
FortiWeb 3000E	64	512	6000	6000	12000	6000	64
FortiWeb 3010E	64	512	6000	6000	12000	6000	64
FortiWeb 4000C	32	512	1024	256	1024	1024	32
FortiWeb 4000D	64	1024	1024	1024	1024	1024	64
FortiWeb 4000E	64	1024	6000	6000	12000	6000	128
FortiWeb-VM	Varies with memory size: 4 (memory < 4G); 12 (memory < 8G); 32 (memory < 16G); 64 (memory >= 16G)	For details, see Maximum values on FortiWeb-VM.	1024	256	1024	1024	Varies with memory size: 4 (memory < =4G); 8 (memory < =8G); 16 (memory < =16G); 32 (memory >16G)

Per appliance configuration maximums - Network and Certificates

The configuration maximums for Network and Certificates apply also at the appliance level.

For the certificates marked with ^ in the following table, their configuration maximums are increased to 5000 on FortiWeb appliances 1000E, 2000E, 3000E, 3010E, and 4000E. For other models, their configuration maximums are as shown in the table.

Web UI item		Main table	Sub-table
System
Network	Interface	1024 (total VLAN interfaces)	N/A
	Policy Route	250	N/A
	Static Route	256	N/A
Certificates	Local^	512	N/A
	Multi-certificate^	256	N/A
	OCSP Stapling	256	N/A
	Inline SNI^	1024	512
	Offline SNI	1024	512
	CA^	256	N/A
	TSL CA	256	N/A
	CA Group	256	256
	Sign CA	256	N/A
	Intermediate CA^	256	N/A
	Intermediate CA Group	256	256
	CRL^	256	N/A
	CRL Group	256	256
	Certificate Verify^	256	N/A
	Server Certificate Verify	256	N/A
	URL Certificate	256	256
	Public Key Pinning	256	N/A
	Server Certificate	256	256
	Client Certificate	256	N/A
	Client Certificate Group	256	256

Per ADOM configuration maximums

The maximums for the following objects apply at the ADOM level only, so you can add objects beyond the maximum by adding ADOMs.

Web UI item		Main table	Sub-table
Web Protection Profile	Inline Protection Profile	256	N/A
Web Protection Profile	Offline Protection Profile	256	N/A
Server Objects
	Health Check	256	16
	Persistence	256	N/A
	HTTP Content Routing	512	256
Protected Hostnames		256	255
Service	Predefined	5	N/A
Service	Custom	256	N/A
Traffic Mirror		256	256
	Predefined Global White List	N/A (Predefined list. Can't be edited)	N/A
	Custom Global White List	256	N/A
	Data Type	No limit	N/A
	Custom Data Type	256	N/A
X- Forwarded-For		256	256
Application Delivery
URL Rewriting Policy	URL Rewriting Policy	256	256
URL Rewriting Policy	URL Rewriting Rule	256	10
Authentication Policy	Authentication Policy	256	256
Authentication Policy	Authentication Rule	256	256
Site Publish	Site Publish Policy	256	256
	Site Publish Rule	256	N/A
	Keytab File	256	N/A
	Authentication Server Pool	256	256
	Service Principal Name Pool	256	256
Compression	File Compress Policy	256	10
Compression	Exclusion Rule	256	256
Caching	Web Cache Policy	256	256
	Bypass URL	256	N/A
	Cookie List	256	N/A
Acceleration	Acceleration Policy	256	N/A
Acceleration	Acceleration Exception	256	256
Web Protection
Known attacks	Signatures/Exceptions	64	Enabled main classes: 64
			Disabled sub-classes: 256
			Disabled signature table: 2048
			Filter table: 10240 Note: It's allowed to create at most 128 filters for the same signature-id.
			Score disable table : 256
			Score grade table : 256
			Alert-only table: 1024
			Disabled False Positive Mitigation table: 256
	Global Disable Signature	1024	N/A
	Custom Signature Group	256	64
	Custom Signature	256	256
Advanced Protection	Custom Policy	1024	1024
	Custom Rule	1024	Source IPv4/IPv6: 256
			GEO IP: 256
			User: 256
			Time period: 1
			URL: 256
			HTTP Header: 256
			Access Rate Limit: 1
			Signature main class: 256
			Signature sub-class: 256
			Signature: 10240
			Custom signature: 1
			Transaction Timeout: 1
			Response Code: 256
			Content Type: 1
			Packet Interval Timeout: 1
			Parameter: 256
			Occurrence: 1
	Padding Oracle Protection	256	256
	CSRF Protection Rule	256	256
	HTTP Header Security Policy	256	256
	Man in the Browser Protection Rule	256	256
	Man in the Browser Protection Policy	256	256
	URL Encryption Policy	256	256
	URL Encryption Rule	256	256
	SQL/XSS Syntax Based Detection	256	256
Cookie Security	Cookie Security	256	256
Input Validation	Parameter Validation Policy	256	1024
	Parameter Validation Rule	1024	192
	Hidden Fields Policy	256	256
	Hidden Fields Rule	256	32 (Hidden Fields Table) 10 (Post URL Table)
	File Security Policy	256	256
	File Security Rule	256	256
Protocol	HTTP Protocol Constraints	256	N/A
	HTTP Constraints Exception	256	32
	WebSocket Security Policy	256	256
	WebSocket Security Rule	256	256
Access	URL Access Policy	1024	1024
	URL Access Rule	1024	32
	Allow Method Policy	256	N/A
	Allow Method Exceptions	256	32
	IP List	256	256
	Geo IP	256	256
	Geo IP Exceptions	256	256
	Allowed Origin	256	256
	CORS Protection Rule	256	256
	CORS Protection Policy	256	256
FTP Security
FTP Command Restriction		256	256
FTP File Security		256	N/A
DoS Protection
Application	HTTP Access Limit	256	N/A
	Malicious IPs	256	N/A
	HTTP Flood Prevention	256	N/A
Network	TCP Flood Prevention	256	N/A
Dos Protection Policy		256	N/A
IP Reputation
Exceptions		256	N/A
Tracking
User Tracking	User Tracking Rule	256	10
User Tracking	User Tracking Policy	256	256
Machine Learning
Anomaly Detection Policy		256	256
Bot Detection Policy		256	256
Machine Learning Templates	URL Replacer Policy	256	256
Machine Learning Templates	URL Replacer Rule	256	256
Predefined Pattern	Data Type Group	256	512
	Data Type	None	N/A
	URL Pattern	None	N/A
	Suspicious URL	256	512
Custom Pattern	Data Type	256	N/A
	Suspicious URL Policy	256	64
	Suspicious URL Rule	256	N/A
Application Templates	Application Policy	256	256
Application Templates	URL Replacer	256	N/A
Web Vulnerability Scan
Web Vulnerability Scan Policy		256	N/A
Scan Profile	Scan Profile	256	N/A
Scan Profile	Scan Template	256	N/A
Web Vulnerability Scan Schedule		256	N/A
Scanner Integration		N/A	N/A
API Protection
JSON Protection	JSON Protection Policy	256	256
	JSON Protection Rule	256	N/A
	JSON Schema	256	N/A
XML Protection	XML Protection Policy	256	256
	XML Protection Rule	256	N/A
	XML Schema	256	N/A
	WSDL	256	N/A
	Exempted URLs	256	256
	WS-Security Rule	256	256
OpenAPI Validation Policy	OpenAPI Validation Policy	256	256
OpenAPI Validation Policy	OpenAPI File	256	N/A
API Gateway	API User	256	32
	API User Group	256	256
	API Gateway Rule	256	N/A
	API Gateway Policy	256	256
Bot Mitigation	Biometrics Based Detection	256	256
	Threshold Based Detection	256	N/A
	Bot Deception	256	256
	Bot Mitigation Policy	256	N/A
	Mobile API Protection Policy	256	256
	Mobile API Protection Rule	256	256
	Known Bots	256	256

Maximum values on FortiWeb-VM

FortiWeb-VM has 10 virtual network interfaces (vNICs, or virtual ports).

The maximum number of server policies initially varies by the maximum amount of virtual memory (vRAM) available to FortiWeb-VM, up to a hard limit. FortiWeb-VM allows up to 20 policies for the first 1 GB of vRAM, then an additional 15 policies per additional 1 GB of vRAM, up to a maximum of 150 server policies.

In other words, at first, the server policy limit increases linearly with vRAM. But after 10 GB of vRAM, further increasing the vRAM no longer has an affect. 11 GB or more vRAM allows up to 150 server policies. Keep in mind that increasing the vRAM may still benefit performance.

Appendix B: Maximum configuration values

Per appliance configuration maximums - ADOMs, server policies, Virtual IPs, server objects, and domains in ML policies

The configuration maximums for the following items apply at the appliance level, and the maximums vary on each model, as shown in the following table.

FortiWeb model	ADOMs	Server policies	Virtual IPs	Server Objects			Domains in all ML policies
FortiWeb model	ADOMs	Server policies	Virtual IPs	Server pools	Pool members	Virtual servers	Domains in all ML policies
FortiWeb 100D	0	32	1024	256	1024	1024	4
FortiWeb 400C	32	64	1024	256	1024	1024	6
FortiWeb 400D	32	64	1024	256	1024	1024	6
FortiWeb 400E	32	64	1024	256	1024	1024	6
FortiWeb 600D	32	96	1024	384	1024	1024	16
FortiWeb 600E	32	96	1024	384	1024	1024	16
FortiWeb 1000D	64	256	1024	512	1024	1024	32
FortiWeb 1000E	64	256	6000	6000	12000	6000	32
FortiWeb 2000E	64	256	6000	6000	12000	6000	64
FortiWeb 3000C	32	256	1024	256	1024	1024	16
FortiWeb 3000CFsx	32	256	1024	256	1024	1024	16
FortiWeb 3000D	64	512	1024	512	1024	1024	32
FortiWeb 3000DFsx	64	512	1024	512	1024	1024	32
FortiWeb 3000E	64	512	6000	6000	12000	6000	64
FortiWeb 3010E	64	512	6000	6000	12000	6000	64
FortiWeb 4000C	32	512	1024	256	1024	1024	32
FortiWeb 4000D	64	1024	1024	1024	1024	1024	64
FortiWeb 4000E	64	1024	6000	6000	12000	6000	128
FortiWeb-VM	Varies with memory size: 4 (memory < 4G); 12 (memory < 8G); 32 (memory < 16G); 64 (memory >= 16G)	For details, see Maximum values on FortiWeb-VM.	1024	256	1024	1024	Varies with memory size: 4 (memory < =4G); 8 (memory < =8G); 16 (memory < =16G); 32 (memory >16G)

Per appliance configuration maximums - Network and Certificates

The configuration maximums for Network and Certificates apply also at the appliance level.

Web UI item		Main table	Sub-table
System
Network	Interface	1024 (total VLAN interfaces)	N/A
	Policy Route	250	N/A
	Static Route	256	N/A
Certificates	Local^	512	N/A
	Multi-certificate^	256	N/A
	OCSP Stapling	256	N/A
	Inline SNI^	1024	512
	Offline SNI	1024	512
	CA^	256	N/A
	TSL CA	256	N/A
	CA Group	256	256
	Sign CA	256	N/A
	Intermediate CA^	256	N/A
	Intermediate CA Group	256	256
	CRL^	256	N/A
	CRL Group	256	256
	Certificate Verify^	256	N/A
	Server Certificate Verify	256	N/A
	URL Certificate	256	256
	Public Key Pinning	256	N/A
	Server Certificate	256	256
	Client Certificate	256	N/A
	Client Certificate Group	256	256

Per ADOM configuration maximums

The maximums for the following objects apply at the ADOM level only, so you can add objects beyond the maximum by adding ADOMs.

Web UI item		Main table	Sub-table
Web Protection Profile	Inline Protection Profile	256	N/A
Web Protection Profile	Offline Protection Profile	256	N/A
Server Objects
	Health Check	256	16
	Persistence	256	N/A
	HTTP Content Routing	512	256
Protected Hostnames		256	255
Service	Predefined	5	N/A
Service	Custom	256	N/A
Traffic Mirror		256	256
	Predefined Global White List	N/A (Predefined list. Can't be edited)	N/A
	Custom Global White List	256	N/A
	Data Type	No limit	N/A
	Custom Data Type	256	N/A
X- Forwarded-For		256	256
Application Delivery
URL Rewriting Policy	URL Rewriting Policy	256	256
URL Rewriting Policy	URL Rewriting Rule	256	10
Authentication Policy	Authentication Policy	256	256
Authentication Policy	Authentication Rule	256	256
Site Publish	Site Publish Policy	256	256
	Site Publish Rule	256	N/A
	Keytab File	256	N/A
	Authentication Server Pool	256	256
	Service Principal Name Pool	256	256
Compression	File Compress Policy	256	10
Compression	Exclusion Rule	256	256
Caching	Web Cache Policy	256	256
	Bypass URL	256	N/A
	Cookie List	256	N/A
Acceleration	Acceleration Policy	256	N/A
Acceleration	Acceleration Exception	256	256
Web Protection
Known attacks	Signatures/Exceptions	64	Enabled main classes: 64
			Disabled sub-classes: 256
			Disabled signature table: 2048
			Filter table: 10240 Note: It's allowed to create at most 128 filters for the same signature-id.
			Score disable table : 256
			Score grade table : 256
			Alert-only table: 1024
			Disabled False Positive Mitigation table: 256
	Global Disable Signature	1024	N/A
	Custom Signature Group	256	64
	Custom Signature	256	256
Advanced Protection	Custom Policy	1024	1024
	Custom Rule	1024	Source IPv4/IPv6: 256
			GEO IP: 256
			User: 256
			Time period: 1
			URL: 256
			HTTP Header: 256
			Access Rate Limit: 1
			Signature main class: 256
			Signature sub-class: 256
			Signature: 10240
			Custom signature: 1
			Transaction Timeout: 1
			Response Code: 256
			Content Type: 1
			Packet Interval Timeout: 1
			Parameter: 256
			Occurrence: 1
	Padding Oracle Protection	256	256
	CSRF Protection Rule	256	256
	HTTP Header Security Policy	256	256
	Man in the Browser Protection Rule	256	256
	Man in the Browser Protection Policy	256	256
	URL Encryption Policy	256	256
	URL Encryption Rule	256	256
	SQL/XSS Syntax Based Detection	256	256
Cookie Security	Cookie Security	256	256
Input Validation	Parameter Validation Policy	256	1024
	Parameter Validation Rule	1024	192
	Hidden Fields Policy	256	256
	Hidden Fields Rule	256	32 (Hidden Fields Table) 10 (Post URL Table)
	File Security Policy	256	256
	File Security Rule	256	256
Protocol	HTTP Protocol Constraints	256	N/A
	HTTP Constraints Exception	256	32
	WebSocket Security Policy	256	256
	WebSocket Security Rule	256	256
Access	URL Access Policy	1024	1024
	URL Access Rule	1024	32
	Allow Method Policy	256	N/A
	Allow Method Exceptions	256	32
	IP List	256	256
	Geo IP	256	256
	Geo IP Exceptions	256	256
	Allowed Origin	256	256
	CORS Protection Rule	256	256
	CORS Protection Policy	256	256
FTP Security
FTP Command Restriction		256	256
FTP File Security		256	N/A
DoS Protection
Application	HTTP Access Limit	256	N/A
	Malicious IPs	256	N/A
	HTTP Flood Prevention	256	N/A
Network	TCP Flood Prevention	256	N/A
Dos Protection Policy		256	N/A
IP Reputation
Exceptions		256	N/A
Tracking
User Tracking	User Tracking Rule	256	10
User Tracking	User Tracking Policy	256	256
Machine Learning
Anomaly Detection Policy		256	256
Bot Detection Policy		256	256
Machine Learning Templates	URL Replacer Policy	256	256
Machine Learning Templates	URL Replacer Rule	256	256
Predefined Pattern	Data Type Group	256	512
	Data Type	None	N/A
	URL Pattern	None	N/A
	Suspicious URL	256	512
Custom Pattern	Data Type	256	N/A
	Suspicious URL Policy	256	64
	Suspicious URL Rule	256	N/A
Application Templates	Application Policy	256	256
Application Templates	URL Replacer	256	N/A
Web Vulnerability Scan
Web Vulnerability Scan Policy		256	N/A
Scan Profile	Scan Profile	256	N/A
Scan Profile	Scan Template	256	N/A
Web Vulnerability Scan Schedule		256	N/A
Scanner Integration		N/A	N/A
API Protection
JSON Protection	JSON Protection Policy	256	256
	JSON Protection Rule	256	N/A
	JSON Schema	256	N/A
XML Protection	XML Protection Policy	256	256
	XML Protection Rule	256	N/A
	XML Schema	256	N/A
	WSDL	256	N/A
	Exempted URLs	256	256
	WS-Security Rule	256	256
OpenAPI Validation Policy	OpenAPI Validation Policy	256	256
OpenAPI Validation Policy	OpenAPI File	256	N/A
API Gateway	API User	256	32
	API User Group	256	256
	API Gateway Rule	256	N/A
	API Gateway Policy	256	256
Bot Mitigation	Biometrics Based Detection	256	256
	Threshold Based Detection	256	N/A
	Bot Deception	256	256
	Bot Mitigation Policy	256	N/A
	Mobile API Protection Policy	256	256
	Mobile API Protection Rule	256	256
	Known Bots	256	256

Maximum values on FortiWeb-VM

FortiWeb-VM has 10 virtual network interfaces (vNICs, or virtual ports).

Secure Networking

Hybrid Mesh Firewall

NOC Management

LAN

WAN

Unified SASE

Single Vendor SASE

Cloud Network Security

Secure Endpoint Connectivity

Web Application / API Protection

Security Operations

Security Operations Automation

Identity

Early Detection & Prevention

Secure Networking

Hybrid Mesh Firewall

NOC Management

LAN

WAN

Communication & Surveillance

Unified SASE

Single Vendor SASE

Secure Endpoint Connectivity

Cloud Network Security

Cloud-Native Security

Web Application / API Protection

Security Operations

Security Operations Automation

Endpoint

Data Protection

Identity

Email

Early Detection & Prevention

Expert Services

Edge Firewall

Orchestration & management

SD Branch

Application Delivery

Single Vendor SASE

Secure Endpoint Connectivity

Secure Private Access

Thin Edge

Identity

Application Gateway

Enterprise Asset Management

Endpoint Agent

Agentless Security Posture

Identity

Wireless

Switching

Identity

Privilege Acccess Management

Next Generation Firewall

Orchestration & management

Expert Services

All

All

Account Management

SAAS Management

SAAS Application Security

Managed Services

Platform as a service (PAAS)

Other SAAS Services

4D Pillars

Cloud

Popular Solutions

Administration Guide

Appendix B: Maximum configuration values

Appendix B: Maximum configuration values

Per appliance configuration maximums - ADOMs, server policies, Virtual IPs, server objects, and domains in ML policies

Per appliance configuration maximums - Network and Certificates

Per ADOM configuration maximums

Maximum values on FortiWeb-VM

Appendix B: Maximum configuration values

Appendix B: Maximum configuration values

Per appliance configuration maximums - ADOMs, server policies, Virtual IPs, server objects, and domains in ML policies

Per appliance configuration maximums - Network and Certificates

Per ADOM configuration maximums

Maximum values on FortiWeb-VM