What's new

Enhanced Geo-IP Filtering with Allow Mode

FortiWeb introduces an Allow Mode for Geo-IP filtering, providing greater flexibility in regional access control. Previously, Geo-IP filtering operated in a Block Mode, where users could only specify locations to block, with optional exceptions for specific IP addresses within those blocked regions. This update introduces a new approach, allowing organizations to define trusted regions while blocking all other geographic locations by default.

Condition	Allow Mode (new)	Block Mode (existing behavior)
Default behavior	Deny all traffic by default	Allow all traffic by default
If traffic origin matches a listed region	Allow traffic from specified regions	Block traffic from specified regions
If traffic origin does not match a listed region	Block traffic from all unlisted regions	Allow traffic from all unlisted regions
If traffic origin matches both a listed region and an exception	Block traffic if the IP matches an exception, even within an allowed region	Allow traffic if the IP matches an exception, even within a blocked region

This enhancement enables a more granular security model, supporting both region-based allow-listing and selective IP-based blocking within trusted regions.

Enhanced Login Status Reporting for Advanced Bot Protection

FortiWeb now enhances integration with the Advanced Bot Protection (ABP) server by reporting login results and additional transaction details to improve bot detection accuracy. Previously, ABP relied on client-side JavaScript for login status tracking, which was ineffective against automated login attacks using scripts or mobile apps.

With this enhancement, FortiWeb directly reports login results for 401 Authentication and Form Authentication methods, enabling ABP to detect unauthorized login attempts more effectively. Additionally, FortiWeb transmits supplementary fields such as tracking numbers and order numbers via attack queries, providing ABP with richer context for bot identification.