waf http-connection-flood-check-rule

waf HTTP-connection-flood-check-rule

Use this command to limit the number of TCP connections per HTTP session. This can prevent TCP connection floods from clients operating behind a shared IP with innocent clients.

Excessive numbers of TCP connections per session can occur if a web application or client is malfunctioning, or if an attacker is attempting to waste socket resources to produce a DoS.

This command is similar to waf layer4-connection-flood-check-rule. However, this feature counts TCP connections per session cookie, while TCP flood prevention counts only TCP connections per IP address. Because it uses session cookies at the application layer instead of only TCP/IP connections at the network layer, this feature can differentiate multiple clients that may be behind the same source IP address, such as when the source IP address hides a subnet that uses network address translation (NAT). However, in order to work, the client must support cookies.

To apply this rule, include it in an application-layer DoS-prevention policy. For details, see waf application-layer-dos-prevention.

To use this command, your administrator account’s access control profile must have either w or rw permission to the wafgrp area. For details, see Permissions.

Syntax

config waf HTTP-connection-flood-check-rule

edit "<rule_name>"

set action {alert | alert_deny | block-period | deny_no_log}

set block-period <seconds_int>

set HTTP-connection-threshold <limit_int>

set severity {High | Medium | Low | Info}

set trigger-policy "<trigger-policy_name>"

end

Variable	Description	Default
"<rule_name>"	Enter the name of a new or existing rule. The maximum length is 63 characters. To display the list of existing rules, enter: `edit ?`	No default.
action {alert \| alert_deny \| block-period \| deny_no_log}	Select one of the following actions that the FortiWeb appliance will perform when the count exceeds the rate limit: `alert`—Accept the connection and generate an alert email and/or log message. `alert_deny`—Block the connection and generate an alert email and/or log message. `block-period`—Block subsequent requests from the client for a number of seconds. Also configure block-period <seconds_int>. `deny_no_log`—Deny a request. Do not generate a log message. Caution: This setting will be ignored if monitor-mode {enable \| disable} is enabled. Note: Logging and/or alert email will occur only if enabled and configured. For details, see log disk and log alertMail. Note: If an auto-learning profile will be selected in the policy with Offline Protection profiles that use this rule, you should select `alert`. If the `action` is `alert_deny`, the FortiWeb appliance will reset the connection when it detects an attack, resulting in incomplete session information for the auto-learning feature. For details about auto-learning requirements, see waf web-protection-profile autolearning-profile.	alert
block-period <seconds_int>	Enter the length of time (in seconds) for which the FortiWeb appliance will block additional requests after a client exceeds the rate threshold. The valid range is 1–3,600 seconds.	`600`
HTTP-connection-threshold <limit_int>	Enter the maximum number of TCP connections allowed from the same client. The valid range is 1–1,024.	1
severity {High \| Medium \| Low \| Info}	Select the severity level to use in logs and reports generated when a violation of the rule occurs.	Medium
trigger-policy "<trigger-policy_name>"	Enter the name of the trigger to apply when this rule is violated. For details, see log trigger-policy. The maximum length is 63 characters. To display the list of existing trigger policies, enter: `set trigger ?`	No default.