Configuring error pages

You can customize an HTML error page that FortiADC can use to respond to clients attempting HTTP/HTTPS connections when the backend real servers are unavailable or the request has violated a policy (such as for security or authentication policies) and the configured action is Alert & Deny or Period Block. From the Application Resources > Error Page, you can create a customized error page by uploading an HTML error page file. You can then edit and preview the HTML file from the GUI. Once the HTML error page has been created, you can select it in virtual server configurations.

Predefined Profiles

To aid you in customizing your HTML error page, FortiADC provides all default error page files that can be downloaded from the predefined profile LB_ERROR_PAGE_DEFAULT. You may use any of these default error page files as a template for customization.

The current error page file package only requests index.html to replace 503 error message when there are no servers in the pool. We also extend the support to these files listed below:

File Name	MUST	Guidelines
Index.html	Yes	When the HTTP status code is 503 (Service Unavailable), this page will replace the error message page.
200.html	No	When the HTTP status code is 200 (OK), this page will replace the error message page.
202.html	No	When the HTTP status code is 202 (Accepted), this page will replace the error message page.
205.html	No	When the HTTP status code is 205 (Reset Content), this page will replace the error message page.
400.html	No	When the HTTP status code is 400 (Bad Request), this page will replace the error message page.
401.html	No	When the HTTP status code is 401 (Unauthorized), this page will replace the error message page.
403.html	No	When the HTTP status code is 403 (Forbidden), this page will replace the error message page.
404.html	No	When the HTTP status code is 404 (Not Found), this page will replace the error message page.
405.html	No	When the HTTP status code is 405 (Method Not Allowed), this page will replace the error message page.
406.html	No	When the HTTP status code is 406 (Not Acceptable), this page will replace the error message page.
408.html	No	When the HTTP status code is 408 (Request Timeout), this page will replace the error message page.
410.html	No	When the HTTP status code is 410 (Gone), this page will replace the error message page.
413.html	No	When the HTTP status code is 413 (Payload Too Large), this page will replace the error message page.
500.html	No	When the HTTP status code is 500 (Internal Server Error), this page will replace the error message page.
501.html	No	When the HTTP status code is 501 (Not Implemented), this page will replace the error message page.
502.html	No	When the HTTP status code is 502 (Bad Gateway), this page will replace the error message page.
504.html	No	When the HTTP status code is 504 (Gateway Timeout), this page will replace the error message page.
waf_deny.html	No	This page will replace all response to a WAF deny action. The error page will show the Message ID, Signature ID, and Client IP of the attack in the message as recorded in the attack log. The error page file does not include the related response-code.html.
default.html	No	This page will replace all other error page doesn’t include in the package (excluding 503).

Alternatively, you do not have to create an HTML error page if you want to simply send a basic text error message when backend servers are unavailable. Instead, you can enter an error message in a text box from within the virtual server configuration. See Configuring virtual servers.

The error message page that displays depends on the action that triggered the response, which can have different response priority depending on whether the error is in response to WAF, server load balancing, or authentication policies. For example, if both the waf_deny and the 403 error pages are in effect, a 403 response code triggered by a WAF action will display the waf_deny page instead of the 403 error page. To learn more about how custom error pages work together with other FortiADC policies, see Understanding custom error page behavior when combined with FortiADC security and authentication policies.

Before you begin:

• You must have Read-Write permission for Server Load Balance settings.
• Copy the error message file to a location you can reach from your browser; the error page file must be named index.html and contained in a tar, tar.gz, or zip file. The maximum file size is 1 MB.

To upload an error message file:

1. Go to Server Load Balance > Application Resources.
2. Click the Error Page tab.
3. Click Create New to display the configuration editor.
4. Enter the name of the error page. You will use this name to select the error page in virtual server configurations. No spaces.
5. Click Choose File and browse and select the error message tar, tar.gz, or zip file. The maximum file size is 1MB.
6. Enter the Virtual Path of the error page. This virtual path will conflict with the custom authentication form base page's virtual path and also with SAML's server URL configuration and Captcha path.
7. Click Save.
   The newly created error page will be listed in the Error Page tab.

To modify an error page:

1. Go to Server Load Balance > Application Resources.
2. Click the Error Page tab.
3. Double-click the error page or select the (edit) icon in the row of the error page that you want to modify.
   The Error Page configuration editor displays.
4. From the configuration editor, you can make the following modifications:
   
   • Upload a new error message file.
   • If the uploaded file is a zip file, edit the file directly through the text editor. The GUI text editor supports HTML, CSS, and JS file types.
     
5. Optionally, click Preview to test and view your HTML error page.
   Note: The preview function only supports HTML files and cannot execute any JavaScript contained in the HTML.
6. Click Save.

Note: While it is possible to modify the error message file, once an error page is created, you cannot modify its name.

Understanding custom error page behavior when combined with FortiADC security and authentication policies

Depending on the FortiADC policy that has triggered the response, certain response codes may take precedence despite having overlapping effective ranges. The following lists the FortiADC security and authentication policies that may affect the response priority for custom error pages.

Trigger	Response priority behavior
WAF (all response codes except 503 and 204)	When an error response is triggered by a WAF action, the waf_deny page will take precedence over any other error page (except for 503 and 204). For example, if a WAF action triggers a 403 response code, the waf_deny page will display instead of the 403 error page. If the desired behavior is to display the 403 error page, then the waf_deny page must be removed.
IP Reputation (403 response code)	If the default and index error pages have been customized: When a 403 response code is triggered, the default page will take precedence over the 403 error page. If only the default page has been customized: When a 403 response code is triggered, the system default error message will display instead of the customized default error page. If all error pages have been customized: The customized 403 error page will display when the 403 response code is triggered.
Authentication (401 response code)	If the default and index error pages have been customized: When a 401 response code is triggered, the default page will take precedence over the 401 error page. If only the default page has been customized: When a 401 response code is triggered, the system default error message will display instead of the customized default error page. If all error pages have been customized: The customized 401 error page will display when the 401 response code is triggered.