Fortinet black logo

CLI Reference

Home FortiWeb 7.2.0 CLI Reference

server-policy ztna-rule

7.2.0
7.4.2
7.4.1
7.4.0
7.2.8
7.2.7
7.2.6
7.2.4
7.2.3
7.2.2
7.2.1
7.2.0
7.0.8
7.0.7
7.0.6
7.0.4
7.0.3
7.0.2
7.0.1
7.0.0
6.4.3
6.4.2
6.4.1
6.4.0
6.3.23
6.3.19
6.3.18
6.3.17
6.3.16
6.3.15
6.3.14
6.3.13
6.3.11
6.3.10
6.3.9
6.3.7
6.3.6
6.3.5
6.3.4
6.3.3
6.3.2
6.3.1
6.3.0
6.2.6
6.2.5
6.2.4
6.2.3
6.2.2
6.2.1
6.2.0
6.1.2
6.1.1
5.7.0
5.6.1
5.6.0
Copy Link
Copy Doc ID 25d54aa6-81be-11ed-8e6d-fa163e15d75b:274630
Download PDF

server-policy ztna-rule

Use this command to configure ZTNA rule.

For more information on ZTNA, please refer to "Chapter: Zero Trust Network Access (ZTNA)" in FortiWeb Administration Guide.

To use this command, your administrator account’s access control profile must have either w or rw permission to the traroutegrp area. For details, see Permissions.

Syntax

config server-policy ztna-rule

edit <ztna-rule_name>

set action {pass | alert_deny | deny_no_log}

config ems-tag-condition

edit <ems-tag-condition_index>

set ems-tag <tag_name>

set combine {and | or}

next

end

config source-address-condition

edit <source-address-condition_index>

set source-address <IP_address>

next

end

config geo-condition

edit <geo-condition_index>

set country-list <country>

next

end

next

end

Variable Description Default

"<ztna-rule_name>"

Enter the name of the ZTNA rule. The maximum length is 63 characters.

To display the list of existing rules, enter:

edit ?

No default.

action {pass | alert_deny | deny_no_log}

Select the specific action to be taken when the request matches the rule.

  • pass—Accept the request.

  • alert_deny—Block the request (or reset the connection) and generate an alert email and/or log message.

  • deny_no_log—Deny a request. Do not generate a log message.

pass

<ems-tag-condition_index>

Enter the EMS tag condition index number.

No default.

ems-tag

Enter the EMS tag to match.

The EMS tags are automatically synchronized from FortiClient EMS.

No default.

combine {and | or}

and means the request only matches if it has all tags specified;

or means the request matches if it has any of the tags specified.

and

<source-address-condition_index>

Enter the source IP address condition index number.

No default.

source-address <IP_address>

Enter one of the following values in Source IPv4/IPv6/IP Range:

  • A single IP address that a client source IP must match, such as a trusted private network IP address (e.g. an administrator’s computer, 192.0.2.109).
  • A range of addresses (e.g., 192.0.2.1-192.0.2.256 or 10:200::10:1-10:200:10:100).

No default.

<geo-condition_index>

Enter the GEO country condition index number.

No default.

set country-list <country>
  • Enter countries to match.

    • No default.

    If multiple conditions are added in one ZTNA rule, the matching logic is:

    • For conditions in different types (Source IP, GEO and ZTNA Tags), their relationship is ALL.

    • For conditions in the same type, their relationship is OR.

    If a request matches with the conditions specified in the rule, FortiWeb will take corresponding actions specified in the rule.

    Related topics

    Previous
    Next

    server-policy ztna-rule

    Use this command to configure ZTNA rule.

    For more information on ZTNA, please refer to "Chapter: Zero Trust Network Access (ZTNA)" in FortiWeb Administration Guide.

    To use this command, your administrator account’s access control profile must have either w or rw permission to the traroutegrp area. For details, see Permissions.

    Syntax

    config server-policy ztna-rule

    edit <ztna-rule_name>

    set action {pass | alert_deny | deny_no_log}

    config ems-tag-condition

    edit <ems-tag-condition_index>

    set ems-tag <tag_name>

    set combine {and | or}

    next

    end

    config source-address-condition

    edit <source-address-condition_index>

    set source-address <IP_address>

    next

    end

    config geo-condition

    edit <geo-condition_index>

    set country-list <country>

    next

    end

    next

    end

    Variable Description Default

    "<ztna-rule_name>"

    Enter the name of the ZTNA rule. The maximum length is 63 characters.

    To display the list of existing rules, enter:

    edit ?

    		No default.

    action {pass | alert_deny | deny_no_log}

    Select the specific action to be taken when the request matches the rule.

    • pass—Accept the request.

    • alert_deny—Block the request (or reset the connection) and generate an alert email and/or log message.

    • deny_no_log—Deny a request. Do not generate a log message.

    		pass

    <ems-tag-condition_index>

    Enter the EMS tag condition index number.

    No default.

    ems-tag

    Enter the EMS tag to match.

    The EMS tags are automatically synchronized from FortiClient EMS.

    No default.

    combine {and | or}

    and means the request only matches if it has all tags specified;

    or means the request matches if it has any of the tags specified.

    and

    <source-address-condition_index>

    Enter the source IP address condition index number.

    No default.

    source-address <IP_address>

    Enter one of the following values in Source IPv4/IPv6/IP Range:

    • A single IP address that a client source IP must match, such as a trusted private network IP address (e.g. an administrator’s computer, 192.0.2.109).
    • A range of addresses (e.g., 192.0.2.1-192.0.2.256 or 10:200::10:1-10:200:10:100).

    No default.

    <geo-condition_index>

    Enter the GEO country condition index number.

    No default.

    set country-list <country>
  • Enter countries to match.

    • No default.

    If multiple conditions are added in one ZTNA rule, the matching logic is:

    • For conditions in different types (Source IP, GEO and ZTNA Tags), their relationship is ALL.

    • For conditions in the same type, their relationship is OR.

    If a request matches with the conditions specified in the rule, FortiWeb will take corresponding actions specified in the rule.

    Related topics

    Previous
    Next