"<offline-protection-profile_name>"

Enter the name of the Offline Protection profile. The maximum length is 63 characters.

To display the list of existing profiles, enter:

edit ?

client-management {enable | disable}

Enable to track the states of HTTP sessions. Also configure waf web-protection-profile offline-protection.

Although HTTP has no inherent support for sessions, a notion of individual HTTP client sessions, rather than simply the source IP address and/or timestamp, is required by some features.

For example, you might want to require that a client’s first HTTP request always be a login page: the rest of the web pages should be inaccessible if they have not authenticated. Out-of-order requests could represent an attempt to bypass the web application’s native authentication mechanism. How can FortiWeb know if a request is the client’s first HTTP request? If FortiWeb were to treat each request independently, without knowledge of anything previous, it could not, by definition, enforce page order. Therefore FortiWeb must keep some record of the first request from that client (the session initiation). It also must record their previous HTTP request(s), until a span of time (the session timeout) has elapsed during which there were no more subsequent requests, after which it would require that the session be initiated again.

The session management feature provides such FortiWeb session support.

Note: This feature requires that the client support cookies.

Note: You must enable this option if you want to

include this profile’s traffic in the traffic log, in addition to enabling traffic logs in general. For details, see log attack-log.

threat-score-profile <name>

Select the Threat Score Profile so that FortiWeb can take action on IPs or clients when their threat score accumulates to a certain value. The threat score profile is configured in config server-policy pattern threat-score-profile.

If you have enabled client-management, but does not configure threat-score-profile, the system will by default applies the configurations in config server-policy pattern threat-weight.

This option is available only when client-management is enabled.

x-forwarded-for-rule "<x-forwarded-for_name>"

Specify the name of a rule that configures FortiWeb’s use of X-Forwarded-For: and X-Real-IP. For details, see waf x-forwarded-for.

To display a list of existing rules, enter:

set forwarded-for-rule ?

HTTP-session-keyword "<key_str>"

If you want to use an HTTP header other than Session-Id: to track separate HTTP sessions, enter the key portion of the HTTP header that you want to use, such as Session-Num.

The maximum length is 63 characters.

signature-rule {"High Level Security" | "Medium Level Security" | "Alert Only" | "<signature-set_name>"}

Specify a signature policy to include in the profile. The maximum length is 63 characters. For details, see waf signature.

To display the list of existing rules, enter:

set server-protection-rule ?

The type of attack that FortiWeb detects determines the attack log messages for this feature. For a list, see waf signature.

amf3-protocol-detection {enable | disable}

Enable to scan requests that use the action message format 3.0 (AMF3) for these attacks if you have enabled those in the set of signatures specified by signature-rule {"High Level Security" | "Medium Level Security" | "Alert Only" | "<signature-set_name>"}:

• Cross-site scripting (XSS) attacks
• SQL injection attacks
• Common exploits

AMF3 is a binary format that can be used by Adobe Flash clients to send input to server-side software.

Caution: To scan for attacks or enforce input rules on AMF3, you must enable this option. Failure to enable the option makes the FortiWeb appliance unable to scan AMF3 requests for attacks.

custom-access-policy "<combo-access_name>"

Enter the name of a custom access policy. The maximum length is 63 characters. For details, see waf custom-access policy.

To display the list of existing policies, enter:

set custom-access-policy ?

padding-oracle "<rule_name>"

Enter the name of a padding oracle protection rule. The maximum length is 63 characters. For details, see waf padding-oracle.

To display the list of existing rules, enter:

set padding-oracle ?

parameter-validation-rule "<rule_name>"

Enter the name of a parameter validation rule. The maximum length is 63 characters. For details, see waf parameter-validation-rule.

To display the list of existing rules, enter:

set parameter-validation-rule ?

hidden-fields-protection "<group_name>"

Enter the name of a hidden field rule group that you want to apply, if any. The maximum length is 63 characters. For details, see waf hidden-fields-protection.

To display the list of existing groups, enter:

set hidden-fields-protection ?

file-upload-policy "<policy_name>"

Enter the name of a file security policy. The maximum length is 63 characters. For details, see server-policy custom-application application-policy.

To display the list of existing policies, enter:

set file-upload-policy ?

HTTP-protocol-parameter-restriction "<constraint_name>"

Enter the name of an HTTP protocol constraint that you want to apply, if any. The maximum length is 63 characters. For details, see waf HTTP-protocol-parameter-restriction.

To display the list of existing constraints, enter:

set HTTP-protocol-parameter-restriction ?

url-access-policy "<policy_name>"

Enter the name of a URL access policy. The maximum length is 63 characters. For details, see waf url-access url-access-policy.

To display the list of existing policies, enter:

set url-access-policy ?

allow-method-policy "<policy_name>"

Enter the name of an allowed method policy. The maximum length is 63 characters. For details, see server-policy custom-application application-policy.

To display the list of existing policies, enter:

set allow-method-policy ?

ip-list-policy "<policy_name>"

Enter the name of a trusted IP or blocklisted IP policy. The maximum length is 63 characters. For details, see server-policy custom-application application-policy.

To display the list of existing policies, enter:

set ip-list-policy ?

geo-block-list-policy "<policy_name>"

Enter the name of a geographically-based client IP block list that you want to apply, if any. The maximum length is 63 characters. For details, see waf geo-block-list.

To display the list of existing policies, enter:

set geo-block-list-policy ?

ip-intelligence {enable | disable}

Enable to apply intelligence about the reputation of the client’s source IP. Blocking and logging behavior is configured in waf ip-intelligence-ignore-x-forwarded-for.

csrf-protection "<rule_name>"

Select the name of cross-site request forgery protection rule, if any, to apply to matching requests. See waf csrf-protection.

To display the list of existing rules, enter:

set csrf-protection ?

Available only when client-management {enable | disable} is enabled.

user-tracking-policy "<user-tracking-policy_name>"

Select the name of a user tracking policy. The maximum length is 63 characters. For details, see waf user-tracking policy.

To display the list of existing policies, enter:

set user-tracking-policy ?

data-analysis {enable | disable}

Enable this to collect data for servers covered by this profile.

comment "<comment_str>"

Enter a description or other comment. If the comment contains more than one word or contains an apostrophe, surround the comment in double quotes ( " ). The maximum length is 199 characters.

mobile-app-identification {enable | disable}

Enable to configure the JWT token secret and token header to verify a request from a mobile application.

Refer to Approov doc for how to get the token.

token-secret <token-secret_str>

Enter the token secret that you have got from Approov.

Available only when mobile-app-identification {enable | disable} is enable.

token-header <token-header_str>

Specify the header where the token is carried.

Available only when mobile-app-identification {enable | disable} is enable.

mobile-api-protection <mobile-api-protection_name>

Select the name of an existing API protection policy. For details, see waf mobile-api-protection.

Available only when mobile-app-identification {enable | disable} is enable.

syntax-based-attack-detection <detection_name>

Select the name of an existing SQL/XSS syntax based detection policy. For details, see waf syntax-based-attack-detection.