system external-resource

Use this command to create IP address connectors which allow you to dynamically import an external block list from an HTTP/HTTPS server in the form of a plain text file. Block lists can be used to enforce special security requirements, such as blocking access from certain IP addresses. The lists are dynamically imported, so that any changes are immediately imported by FortiWeb.

After you have imported your external block list through the IP Address connector, you can apply the IP External resource in IP Protection > IP List.

To use this command, your administrator account’s access control profile must have either w or rw permission to the sysgrp area. For details, see Permissions.

Syntax

config system external-resource

edit <external-IP-name>

set status {enable | disable}

set protocol {HTTP | HTTPS}

set local-cert <cert-name>

set verify-host-cert {enable | disable}

set ca <ca_cert_name>

set http-basic-authentication {enable | disable}

set username <string> #HTTP basic authentication username

set password <string> #HTTP basic authentication password

set refresh-rate <int> #Time interval to refresh external resource (1 – 43200 min)

set resource <string> #external-resource enable/disable

next

end

Variable	Description	Default
<external-IP-name>	Specify the name of the IP Address connector. Valid characters are A-Z, a-z, 0-9, _, and -. No spaces.	No default
status {enable | disable}	Enable the external IP connector.	disable
protocol {HTTP | HTTPS}	Select the protocol used for the connections between FortiWeb and the IP External resource.	HTTP
local-cert <cert-name>	Select the TLS certificate used for the HTTPS connection between FortiWeb and the IP External resource. It should be uploaded in the Local tab in Sever Objects > Certificates > Local. Available only if HTTPS is selected for Protocol.	No default
verify-host-cert {enable | disable}	Enable this option to verify the IP External resource's URI is valid by checking the ownership of the CA certificate. Available only if HTTPS is selected for Protocol.	disable
ca <ca_cert_name>	Select the CA certificate of the IP External resource's URI. It should be uploaded in the CA tab in Sever Objects > Certificates > CA. Available only if HTTPS is selected for Protocol.	No default
username <string>	Specify the username to be used to access this IP address list. With username and password specified, the system will automatically enable HTTP Basic Authentication.	No default
password <string>	Specify the password to be used to access this IP address list. With username and password specified, the system will automatically enable HTTP Basic Authentication.	No default
refresh-rate <int>	Specify the refresh rate in minutes. (Default: 5. Range: 1-43200 minutes). FortiWeb will retrieve the data from the HTTP/HTTPS server periodically according to the refresh rate.	5
resource <string>	Specify the URI of the HTTP/HTTPS server where the IP address list is stored.	No default

Related topics

• waf ip-list