waf grpc-security rule

Use this command to configure gRPC related settings.

To use this command, your administrator account’s access control profile must have either w or rw permission to the wafgrp area. For details, see Permissions.

Syntax

config waf grpc-security rule

edit grpc-security_rule_name

set host-status {enable | disable}

set host <host_str>

set url <url_str>

set idl-file <file_name>

set rate-limit <int>

set size-limit <int>

set req-message-name <string>

set rsp-message-name <string>

set action {alert | deny_no_log | alert_deny | block-period}

set block-period <int>

set severity {High | Medium | Low | Info}

set trigger <trigger-policy_name>

end

Variable	Description	Default
grpc-security_rule_name	Enter the WebSocket security rule name.	No default.
host-status {enable \| disable}	Enable to compare the WebSocket security rule to the `Host:` field in the HTTP header.	No default.
host <host_str>	Select the IP address or fully qualified domain name (FQDN) of the protected host to which this rule applies. This option is available only if Host Status is enabled.	No default.
url <url_str>	The URL of the gPRC API request you want to protect. You can enter the literal URL, such as `/folder1/index.htm` that the HTTP request must contain in order to match the rule, or use wildcards to match multiple URLs, such as `/folder1/` or `/folder1//index.htm`. The URL must begin with a slash ( `/` ).	No default.
idl-file <file_name>	Enter the name of the IDL file you have uploaded in the gRPC IDL File tab in Web Protection > Protocol > gRPC. FortiWeb will decode the traffic according to the IDL file.	No default.
rate-limit <int>	Specify the maximum number of messages within a gRPC API request.	20
size-limit <int>	Specify the maximum size of each message body in a gRPC API request.	4194303
req-message-name <string>	The name of message in the gRPC API request. FortiWeb will apply this gRPC security rule to the matched message. The format should be "<package_name>.<message_name>", for example `routeguide.Point`. It's case sensitive.	No default.
rsp-message-name <string>	The name of message in the gRPC API response. FortiWeb will apply this gRPC security rule to the matched message. Refer to `req-message-name` for the format of the name.	No default.
action {alert \| deny_no_log \| alert_deny \| block-period}	Select which action the FortiWeb appliance will take when it detects a violation. Alert—Accept the connection and generate an alert email and/or log message. alert_deny—Block the request (or reset the connection) and generate an alert and/or log message. deny_no_log—Block the request (or reset the connection). block-period—Block subsequent requests from the client for a number of seconds. Also configure waf grpc-security rule.	`Alert`
block-period <int>	If `action` is `block-period`, type the number of seconds that the client will be blocked.	600
severity {High \| Medium \| Low \| Info}	Select the severity level to use in logs and reports generated when a violation of the rule occurs.	medium
trigger <trigger-policy_name>	Enter the name of the trigger to apply when this rule is violated (see log trigger-policy). The maximum length is 63 characters. To display the list of existing trigger policies, enter: `set trigger ?`	No default.

CLI Reference

waf grpc-security rule

Syntax

Related topics

waf grpc-security rule

Syntax

Related topics