Fortinet Document Library

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:


Table of Contents

CLI Reference

waf mobile-api-protection

When a client accesses a web server from a mobile application, the Mobile Application Identification module checks whether the request carries the JWT-token field and whether the token carried is valid, and sets flags for the following cases:

  • The traffic doesn't carry the JWT-token header
  • The traffic carries the JWT-token header and the token is valid
  • The traffic carries the JWT-token header, while the token is invalid

The mobile API protection feature checks the flags. With the API protection policy and rule configured, actions set in the protection rule will be performed.

Syntax

config waf mobile-api-protection-rule

edit <mobile-api-protection-rule_name>

set host-status {enable | disable}

set host <host_str>

set action {alert | deny_no_log | alert_deny | block-period}

set block-period <block-period_int>

set severity {High | Medium | Low | Info}

set trigger <trigger_policy_name>

config url-list

edit <url-list_id>

set url-type {plain | regular}

set url-pattern <url-pattern_str>

next

end

next

end

 

config waf mobile-api-protection-policy

edit <mobile-api-protection-policy_name>

config rule-list

edit <rule-list_id>

set rule <rule_name>

next

end

next

end

Variable

Description

Default

<mobile-api-protection-rule_name>

Enter the name for the mobile API protection rule.

No default.

host-status {enable | disable}

Enable to compare the mobile API protection rule to the Host: field in the HTTP header. Disable

host <host_str>

Select the IP address or fully qualified domain name (FQDN) of the protected host to which this rule applies.
This option is available only if host-status {enable | disable} is enable.
No default.

action {alert | deny_no_log | alert_deny | block-period}

Select which action the FortiWeb appliance will take when it detects a violation.
alert—Accept the connection and generate an alert email and/or log message.
alert_deny—Block the request (or reset the connection) and generate an alert and/or log message.
deny_no_log—Block the request (or reset the connection).

block-period—Blocks the request for a certain period of time.

Alert

block-period <block-period_int>

Enter the number of seconds that you want to block the requests. The valid range is 1–3,600 seconds.

This option only takes effect when you choose Period Block in action {alert | deny_no_log | alert_deny | block-period}.

600

severity {High | Medium | Low | Info}

When FortiWeb records rule violations in the attack log, each log message contains a Severity Level field. Select the severity level that FortiWeb will record when the rule is violated:

  • Low
  • Medium
  • High
  • Informative

The default value is High.

High

trigger <trigger_policy_name>

Select the trigger, if any, that FortiWeb carries out when it logs and/or sends an alert email about a rule violation. For details, see Viewing log messages.

No default.

<url-list_id>

Type the index number of the individual URL within the URL list, or keep the field’s default value of auto to let the FortiWeb appliance automatically assign the next available index number.

No default.

url-type {plain | regular}

Select whether the URL Pattern field will contain a literal URL (plain), or a regular expression designed to match multiple URLs (regular). plain

url-pattern <url-pattern_str>

Depending on the url-type, enter either:

  • plain—The literal URL, such as /index.php, that the HTTP request must contain in order to match the rule. The URL must begin with a slash ( / ).
  • regular—A regular expression, such as ^/*.php, matching the URLs to which the rule should apply. The pattern does not require a slash ( / ), but it must match URLs that begin with a slash, such as /index.cfm.

Do not include the domain name, such as www.example.com, which is configured separately in [bot-detection-exception-list] <No.> host <string>.

No default

<mobile-api-protection-policy_name>

Enter the name for the mobile API protection policy.

No default.

<rule-list_id>

Type the index number of the individual rule within the rule list, or keep the field’s default value of auto to let the FortiWeb appliance automatically assign the next available index number.

No default.

rule <rule_name>

Select the mobile API protection rule from the drop-down list.

No default.

waf mobile-api-protection

When a client accesses a web server from a mobile application, the Mobile Application Identification module checks whether the request carries the JWT-token field and whether the token carried is valid, and sets flags for the following cases:

  • The traffic doesn't carry the JWT-token header
  • The traffic carries the JWT-token header and the token is valid
  • The traffic carries the JWT-token header, while the token is invalid

The mobile API protection feature checks the flags. With the API protection policy and rule configured, actions set in the protection rule will be performed.

Syntax

config waf mobile-api-protection-rule

edit <mobile-api-protection-rule_name>

set host-status {enable | disable}

set host <host_str>

set action {alert | deny_no_log | alert_deny | block-period}

set block-period <block-period_int>

set severity {High | Medium | Low | Info}

set trigger <trigger_policy_name>

config url-list

edit <url-list_id>

set url-type {plain | regular}

set url-pattern <url-pattern_str>

next

end

next

end

 

config waf mobile-api-protection-policy

edit <mobile-api-protection-policy_name>

config rule-list

edit <rule-list_id>

set rule <rule_name>

next

end

next

end

Variable

Description

Default

<mobile-api-protection-rule_name>

Enter the name for the mobile API protection rule.

No default.

host-status {enable | disable}

Enable to compare the mobile API protection rule to the Host: field in the HTTP header. Disable

host <host_str>

Select the IP address or fully qualified domain name (FQDN) of the protected host to which this rule applies.
This option is available only if host-status {enable | disable} is enable.
No default.

action {alert | deny_no_log | alert_deny | block-period}

Select which action the FortiWeb appliance will take when it detects a violation.
alert—Accept the connection and generate an alert email and/or log message.
alert_deny—Block the request (or reset the connection) and generate an alert and/or log message.
deny_no_log—Block the request (or reset the connection).

block-period—Blocks the request for a certain period of time.

Alert

block-period <block-period_int>

Enter the number of seconds that you want to block the requests. The valid range is 1–3,600 seconds.

This option only takes effect when you choose Period Block in action {alert | deny_no_log | alert_deny | block-period}.

600

severity {High | Medium | Low | Info}

When FortiWeb records rule violations in the attack log, each log message contains a Severity Level field. Select the severity level that FortiWeb will record when the rule is violated:

  • Low
  • Medium
  • High
  • Informative

The default value is High.

High

trigger <trigger_policy_name>

Select the trigger, if any, that FortiWeb carries out when it logs and/or sends an alert email about a rule violation. For details, see Viewing log messages.

No default.

<url-list_id>

Type the index number of the individual URL within the URL list, or keep the field’s default value of auto to let the FortiWeb appliance automatically assign the next available index number.

No default.

url-type {plain | regular}

Select whether the URL Pattern field will contain a literal URL (plain), or a regular expression designed to match multiple URLs (regular). plain

url-pattern <url-pattern_str>

Depending on the url-type, enter either:

  • plain—The literal URL, such as /index.php, that the HTTP request must contain in order to match the rule. The URL must begin with a slash ( / ).
  • regular—A regular expression, such as ^/*.php, matching the URLs to which the rule should apply. The pattern does not require a slash ( / ), but it must match URLs that begin with a slash, such as /index.cfm.

Do not include the domain name, such as www.example.com, which is configured separately in [bot-detection-exception-list] <No.> host <string>.

No default

<mobile-api-protection-policy_name>

Enter the name for the mobile API protection policy.

No default.

<rule-list_id>

Type the index number of the individual rule within the rule list, or keep the field’s default value of auto to let the FortiWeb appliance automatically assign the next available index number.

No default.

rule <rule_name>

Select the mobile API protection rule from the drop-down list.

No default.