Client ID–Based Occurrence Tracking for Threshold Based Detection (8.0.0)

FortiWeb 8.0.0 introduces a new tracking mode for Threshold-Based Detection policies that enables occurrence counting by Client ID rather than Client IP. This enhancement leverages the Client Management module, which issues persistent cookies to uniquely identify and monitor clients across sessions. This allows for more precise behavior analysis in use cases such as vulnerability scanning, content scraping, brute-force logins, and crawler detection.

Tracking Method Selection

A new Tracking by option is now available in both the GUI and CLI, allowing administrators to choose between Client IP and Client ID tracking. The selection applies globally across all supported detection modules except Slow Header Attack, which automatically defaults to IP-based tracking due to technical limitations. For details, see Slow Header Attack Detection (8.0.0).

When Tracking by is set to Client ID:

• Client ID Block Period replaces the standard Block Period action in detection rules. This ensures blocking is enforced based on the client’s persistent identifier rather than source IP.

• If Client Management is not enabled in the associated protection profile, the system will prompt you to enable it, as Client ID tracking depends on its cookie mechanism.

• The standard Block Period action becomes unavailable to avoid configuration conflicts.

When Tracking by is set to Client IP:

• Standard Block Period is available for use in detection action settings.

• Client ID Block Period options are hidden to prevent misconfiguration.

To configure the tracking method via CLI:

config waf threshold-based-detection policy
  edit "<policy_name>"
    set tracking-type {client-ip | client-id}
  next
end

Processing Logic and Compatibility

Each detection module maintains a separate occurrence counter based on the selected tracking mode. When Client ID is used, tracking is based on the persistent client cookie; when Client IP is selected, tracking is based on source IP address.

The Slow Header Attack detection mechanism does not support Client ID–based tracking. If tracking is configured to use Client ID, FortiWeb will automatically fall back to IP-based tracking for Slow Header Attack events. If Client ID Block Period is configured, enforcement will be carried out using IP-based period blocking. For more information, see Slow Header Attack Detection (8.0.0).

Upgrade Considerations

• Upon upgrading to FortiWeb 8.0.0, any existing action set to Client ID Block Period will be automatically converted to Block Period to maintain policy compatibility.

• No downgrade-specific migration is required.