<client_ipv4mask>

Enter an IP address and netmask that you want to exempt from concurrent request rate limits.

<list_index>

Enter a number to identify the entry in the table.

client-ip-x-header-name <key_str>

Enter the name of the HTTP X-header. Do not include the colon ( : ) after the name.

This setting is used if client-ip-x-header-status {enable | disable} is enable.

client-ip-x-header-status {enable | disable}

Enable to identify the IP addresses of clients behind a proxy or load balancer by using an HTTP X-header. Also configure client-ip-x-header-name <key_str>.

In a network topology where web service clients connect through a proxy, load balancer, or web application firewall (for example, a FortiWeb that is not transparent), the source IP address in the IP packet header is changed to be the proxy itself instead of the original client. Therefore if any attacker or misconfigured agent exceeds the limits, then FortiMail would block the proxy — and therefore all innocent clients that connect through the proxy — not only the bad client. Log messages would also indicate that the problem is the proxy, instead of the real endpoint. To solve this:

1. On the upstream proxy:

   1. Choose which X-header will identify the original client.

      To see whether an X-header is already being used in requests, you can use a packet capture tool.

   2. If the X-header does not exist in requests yet, insert it with the original client's public IP address.

      RFC 1918 private network addresses are not globally unique identifiers, and should not be used to avoid effecting other clients with the same private network address. Due to network address translation (NAT), however, multiple clients still could be behind the same public IP address. This is a known limitation of networks with NAT.

   3. If the X-header exists in requests already, but either it contains a list of multiple addresses, or it was not inserted by a trusted proxy that you control, then replace it with the original client's public IP address or, if that cannot be done, remove the header.

      Lists, if any, start with the original client IP address but may be in order of left-to-right, or right-to-left. Keep only the first public IP address, relative to that direction. For example, if this header is left-to-right:

      X-Forwarded-For: 10.0.0.1, 1.1.1.1, 2.2.2.2, 192.168.0.2

      then replace it with:

      X-Forwarded-For: 1.1.1.1

   4. On FortiMail, enable client-ip-x-header-status {enable | disable} and enter the name of the X-header.

      Do not enable this setting unless you are sure that only a trusted proxy can insert the X-header. X-headers are not encrypted nor authenticated, and could be forgeries.

      If you enable the setting but the X-header does not exist or is empty, FortiMail will act as if the setting is disabled, and instead use the source IP address In the IP header.

Enter the fully qualified domain name (FQDN) to use to use in HTTPS redirects for the FortiMail system.

Enable to redirect insecure HTTP requests to secure access using HTTPS.

This setting affects all FortiMail URLs: REST APIs, administrator GUI, FortiMail webmail, and personal quarantines.

For this setting to take effect, you must also enable both HTTP and HTTPS access protocols on the network interface(s) that receive these connections. FortiMail cannot redirect HTTP if it is not listening for it. See allowaccess {ping http https snmp ssh telnet}.

ip-address <client_ipv4>

Enter an IP address that you want to exempt from the repeat offender list.

This setting is used if repeat-offender-status {enable | disable} is enable.

max-active-session-admin <limit_int>

Enter the maximum number of active administrator sessions.

max-active-session-restful <limit_int>

Enter the maximum number of active REST API sessions.

max-concurrent-request-admin <limit_int>

Enter the maximum number of concurrent administrative GUI requests.

max-concurrent-request-all <limit_int>

Enter the maximum number of concurrent HTTP requests from all clients.

max-concurrent-request-ms365 <limit_int>

Enter the maximum number of concurrent Microsoft 365 or Google API requests permitted.

max-concurrent-request-per-ip <limit_int

Enter the maximum number of concurrent HTTP requests for a single IP address.

max-concurrent-request-restful <limit_int>

Enter the maximum number of concurrent REST API requests.

max-concurrent-request-webmail <limit_int>

Enter the maximum number of concurrent webmail or personal quarantine requests.

Valid ranges and default setting varies by platform. For details, see FortiMail Maximum Values.

max-request-rate-admin <limit_int>

Enter the maximum request rate per second for administrators.

max-request-rate-ms365 <limit_int>

Enter the maximum request rate (per second) for Microsoft 365 or Google cloud APIs.

max-request-rate-restful <limit_int>

Enter the maximum request rate per second to the REST API.

max-request-rate-webmail <limit_int>

Enter the maximum request rate per second for webmail or personal quarantines.

repeat-offender-count <limit_int>

Enter the threshold for how many bad requests within the time period will trigger repeat offender control. Valid range is 1 to 50.

This setting is used if repeat-offender-status {enable | disable} is enable.

repeat-offender-period <minutes_int>

Enter the range of time in minutes during which to count the number of bad requests. Valid range is 1 to 120.

This setting is used if repeat-offender-status {enable | disable} is enable.

repeat-offender-status {enable | disable}

Enable to block the IP addresses that repeatedly send HTTP requests to FortiMail that result in HTTP 404 or 405 errors. Also configure repeat-offender-count <limit_int> and repeat-offender-period <minutes_int>.

For example, if FortiMail receives 3 bad requests during a 5 minute interval, that IP address will be blocked for the remaining of the 5 minute interval. After the interval expires, the client IP address will be able to send requests again and the counter will restart for the next interval.

Enable or disable access to the FortiMail REST API.

For this setting to take effect, you must also enable HTTPS access protocols on the network interface(s) that receive these connections. FortiMail cannot respond to an API requestif it is not listening for it. See allowaccess {ping http https snmp ssh telnet}.