config security dos http-access-limit
HTTP Access Limit policies can control the rate of HTTP requests from a source IP. The "Limit Request by IP" feature restricts the number of HTTP requests per second per source IP address. This helps prevent HTTP request floods involving multiple URLs and can identify source IP addresses shared by multiple clients. Even when clients do not support cookies, the system can intelligently apply separate request rate limits for those IPs.
Before you begin:
- You must have Read-Write permission for Security settings.
After you have configured HTTP Access Limit policies, you can select them in DoS Protection Profile.
Syntax
config security dos http-access-limit
edit <name>
set status {enable|disable}
set access-limit-per-ip <integer>
set action {pass|deny|period-block|captcha}
set log {enable|disable}
set severity {high|medium|low}
next
end
|
status |
Enable or disable this HTTP Connection Flood policy. This is disabled by default. |
|
access-limit-per-ip |
Specify the maximum number of HTTP requests allowed per second from a specific IP address. A value of 0 disables the limit, allowing unlimited HTTP requests. The default value is set to 0, with an acceptable range of 0-65535. When FortiADC receives multiple HTTP requests from the same source IP within one second, it checks whether the request count exceeds the specified limit. If the limit is reached, FortiADC takes the configured action. The one-second timer starts when the first request is received, and the count block is automatically cleared after the one-second period elapses. |
|
action |
Specify the action to take when the HTTP Connection Flood policy is triggered.
|
|
block-period |
The block-period option is available is action is period-block. Specify the duration (in seconds) for blocking connections. The default value is 60 seconds, with an acceptable range of 1 to 3600 seconds. During this period, HTTP requests containing the blocked cookie will result in the associated TCP connection being terminated. This blocking action persists even after the FortiADC is rebooted. |
|
log |
Enable or Disable logging. When enabled, the action will be logged. |
|
severity |
Select the severity level.
The default value is high. |
Example
config security dos http-access-limit
edit "a1"
set status enable
set access-limit-per-ip 5
set action deny
set log enable
set severity medium
next
end