"<routing-policy_name>"

Enter the name of the HTTP content routing policy. The maximum length is 63 characters.

To display the list of existing policies, enter:

edit ?

server-pool "<server-pool_name>"

Enter the name of the server pool to which FortiWeb forwards traffic when the traffic matches rules in this policy.

For details, see server-policy server-pool.

<entry_index>

HTTP-content-routing-id <HTTP-content-routing-id_str>

Enter a HTTP content routing policy sequence number.

match-object {HTTP-host | HTTP-request | url-parameter | HTTP-referer | HTTP-cookie | HTTP-header | source-ip | x509-certificate-Subject | x509-certificate-Extension | HTTPS-sni | geo-ip | ztna-ems-tags}

Enter the type of object that FortiWeb examines for matching values:

• HTTP-host—Host: field
• HTTP-request—A URL
• url-parameter—A URL parameter and value
• HTTP-referer—Referer: field
• HTTP-cookie—A cookie name and value
• HTTP-header—A header name and value
• source-ip—An IPv4 address or address range or IPv6 address or address range
• x509-certificate-Subject—A specified Relative Distinguished Name (RDN) in the X509 certificate Subject field. Also specify x509-subject-name.
• x509-certificate-Extension—Additional fields that the extensions field adds to the X509 certificate
• HTTPS-sni— Select this option so that FortiWeb will forward requests based on the SNI in the SSL handshake.
• geo-ip— Select this option so that FortiWeb matches against the IP addresses from specified countries.

• ztna-ems-tags— Select this option so that FortiWeb matches against the ZTNA tags.

match-condition {match-begin | match-end | match-sub | match-domain | match-dir | match-reg | ip-range | ip-range6 | equal | ip-list}

Enter the type of value to match. Values can be a literal value that appears in the object or a regular expression.

The value of match-object {HTTP-host | HTTP-request | url-parameter | HTTP-referer | HTTP-cookie | HTTP-header | source-ip | x509-certificate-Subject | x509-certificate-Extension | HTTPS-sni | geo-ip | ztna-ems-tags} determines which content types you can specify.

If match-object is HTTP-host, HTTP-request, HTTP-referer, or x509-certificate-Extension:

• match-begin—The object to match begins with the specified string.
• match-end—The object to match ends with the specified string.
• match-sub—The object to match contains the specified string.
• match-domain—The host to match contains the specified string between the periods in a domain name.
• ip-list—The IPs to match.

If match-object is HTTP-host only:

• match-domain—The object to match contains the specified string between the periods in a domain name.
  
  For example, if match-expression is abc, the condition matches the following hostnames:
  
  dname1.abc.com
dname1.dname2.abc.com
  
  However, the same Match Simple String value does not match the following hostnames:
  
  abc.com
dname.abc
  
  

If match-object is HTTP-request:

• match-dir—The object to match contains the specified string between delimiting characters (slash) in a domain name.
  
  For example, if match-expression is abc, the condition matches the following hostnames:
  
  test.com/abc/
test.com/dir1/abc/
  
  However, the same match-string value does not match the following hostnames:
  
  test.com/abc
test.abc.com

If match-object is source-ip:

• ip-range—The source IP to match is an IPv4 IP address or within a range of IPv4 IP addresses.
• ip-range6—The source IP to match is an IPv6 IP address or within a range of IPv6 IP addresses.

If match-object is HTTP-host, HTTP-request, HTTP-referer, source-ip, or x509-certificate-Extension:

• match-reg—The object to match has a value that matches the specified regular expression.

ztna-ems-tag <tag_name>

If match-object is ztna-ems-tags, enter the tag names.

ztna-ems-tag-combine {and | or}

Available only if match-object is ztna-ems-tags.

and means the request only matches if it has all tags specified;

or means the request matches if it has any of the tags specified.

Note: For ZTNA tags, when Reverse is on, it means all the request will be matched except the ones that meet the or or and condition.

For example, if Tag_A and Tag_B are specified, and the Reverse is on, the matching logic will be:

• When ztna-ems-tag-combine is or, all the request will be matched except the ones having any of the Tag_A and Tag_B tags.

• When ztna-ems-tag-combine is and, all the requests will be matched except the ones having both Tag_A and Tag_B tags.

x509-subject-name {E | CN | OU | O | L | ST | C}

match-expression "<match-expression_str>"

Enter a value to match in the object element specified by match-object {HTTP-host | HTTP-request | url-parameter | HTTP-referer | HTTP-cookie | HTTP-header | source-ip | x509-certificate-Subject | x509-certificate-Extension | HTTPS-sni | geo-ip | ztna-ems-tags} and match-condition.

Examples:

• A literal URL, such as /index.php, that a matching HTTP request contains.
• An expression, such as ^/*.php, that matches a URL.

Tip: When you enter a regular expression using the web UI, you can validate its syntax.

value-match-condition {match-begin | match-end | match-sub | match-reg | equal}

Enter the type of value to match. The value refers to the x509-subject-name and can be a literal value that appears in the object or a regular expression.

• match-begin—The name to match begins with the specified string.
• match-end—The name to match ends with the specified string.
• match-sub—The name to match contains the specified string.
• equal—The name to match is the specified string.
• match-reg—The name to match matches the specified regular expression.

name "<name_str>"

Enter the name of the object to match. The value can be a literal value or a regular expression.

For example, the name of a cookie embedded by traffic controller software on one of the servers.

Available only if match-object {HTTP-host | HTTP-request | url-parameter | HTTP-referer | HTTP-cookie | HTTP-header | source-ip | x509-certificate-Subject | x509-certificate-Extension | HTTPS-sni | geo-ip | ztna-ems-tags} is url-parameter, HTTP-cookie, or HTTP-header.

name-match-condition {match-begin | match-end | match-sub | match-reg | equal}

Enter the type of value to match. The value is specified by name and can be a literal value that appears in the object or a regular expression.

• match-begin—The name to match begins with the specified string.
• match-end—The name to match ends with the specified string.
• match-sub—The name to match contains the specified string.
• equal—The name to match is the specified string.
• match-reg—The name to match matches the specified regular expression.

value "<value_str>"

Enter the object value to match. The value can be a literal value or a regular expression.

Available if match-object {HTTP-host | HTTP-request | url-parameter | HTTP-referer | HTTP-cookie | HTTP-header | source-ip | x509-certificate-Subject | x509-certificate-Extension | HTTPS-sni | geo-ip | ztna-ems-tags} is url-parameter, HTTP-cookie, or HTTP-header.

value-match-condition {match-begin | match-end | match-sub | match-reg | equal}

Enter the type of value to match. The value is specified by value and can be a literal value or a regular expression.

• match-begin—The value to match begins with the specified string.
• match-end—The value to match ends with the specified string.
• match-sub—The value to match contains the specified string.
• equal—The value to match is the specified string.
• match-reg—The value to match matches the specified regular expression.

start-ip "<start_ip>"

Enter the first IP address in a range of IP addresses.

Available if match-condition {match-begin | match-end | match-sub | match-domain | match-dir | match-reg | ip-range | ip-range6 | equal | ip-list} is ip-range or ip-range6.

end-ip "<end_ip>"

Enter the last IP address in a range of IP addresses.

Available if match-object {HTTP-host | HTTP-request | url-parameter | HTTP-referer | HTTP-cookie | HTTP-header | source-ip | x509-certificate-Subject | x509-certificate-Extension | HTTPS-sni | geo-ip | ztna-ems-tags} is source-ip

Select countries where the IP addresses originate.

concatenate {and | or}

Select either:

• and—A matching request matches this entry in addition to other entries in the HTTP content routing list.
• or—A matching request matches this entry or other entries in the list.