"<ip-list_name>"

Enter the name of a new or existing rule. The maximum length is 63 characters.

To display the list of existing rules, enter:

edit ?

action { alert_deny | block-period | deny_no_log}

Select which action FortiWeb will take when it detects a violation of the rule:

• alert_deny—Block the request (or reset the connection) and generate an alert and/or log message.

• deny_no_log—Block the request (or reset the connection).

• block-period—Block subsequent requests from the client for a number of seconds. Also configure block-period.

Note: This setting will be ignored if monitor-mode {enable | disable} is enabled in a server policy.

block-period <block_period_int>

Enter the number of seconds that you want to block subsequent requests from a client after FortiWeb detects that the client has violated the rule. The valid range is 1–3,600 seconds.

This setting is available only if Action is set to block-period.

severity {Low | Medium | High | Info}

When rule violations are recorded in the attack log, each log message contains a Severity Level (severity_level) field. Select which severity level the FortiWeb appliance will use when a blacklisted IP address attempts to connect to your web servers:

• Low
• Medium
• High
• info

trigger-policy "<trigger-policy_name>"

Select which trigger, if any, that the FortiWeb appliance will use when it logs and/or sends an alert email about a blacklisted IP address’s attempt to connect to your web servers. The maximum length is 63 characters. For details, see log trigger-policy.

To display the list of existing trigger policies, enter:

set trigger ?

ignore-x-forwarded-for {enable | disable}

By default, FortiWeb scans the IP addresses in the X-Forwarded-For header at the HTTP layer. This causes high resource consumption. To enhance the performance, you can enable Ignore X-Forwarded-For so that the IP addresses can be scanned at the TCP layer instead. This avoids HTTP packets being processed unnecessarily.

<entry_index>

group-type {ip-string | ip-group | IP-external}

Select ip-string to enter IP addresses or ranges, or ip-group to reference the IP groups you have created through config server-policy ip-group, or IP-external to reference an external IP address resource you have created through config system external-resource.

ip "<client_ip>"

If you have selected ip-string for group-type, then enter one of the following values:

• A single IP address that a client source IP must match, such as a trusted private network IP address (e.g. an administrator’s computer, 172.16.1.20). Multiple addresses or ranges should be separated with comma ",".
• A range or addresses (e.g. 1.2.3.4,2001::1,1.2.3.4-1.2.3.40,2001::1-2001::100).

ip-group <name>

If you have selected ip-group for group-type, then specify the IP Group you have created through config server-policy ip-group. By using the IP group, you can save the effort to type the IP addresses every time you need to re-use them.