Create a new central DNAT or IPv6 central DNAT policy

add-nat46-route

Enable or disable adding NAT46 to a route.

This option is not available for IPv6 policies.

add-nat64-route

Enable or disable adding NAT64 to a route.

This option is only available for IPv6 policies.

dns-mapping-ttl

Enter time-to-live for DNS response, from 0 to 604 800. Set to to 0 to use the DNS server's response time.

This option is not available for IPv6 policies.

extaddr

Select an external FQDN.

This option is not available for IPv6 policies.

gratuitous-arp-interval

Set the time intervalin seconds between sending of gratuitous address resolution protocol (ARP) packets by a virtual IP. Set to 0 to disable this feature. Set from 5 to 8640000 seconds to enable

This option is not available for IPv6 policies.

http-cookie-age

Set the time in minutes that client web browsers should keep a cookie. Set to 0 for no time limit.

http-cookie-domain

Enter the domain name to which cookie persistence should apply.

http-cookie-domain-from-host

Enable or disable use of the HTTP cookie domain from the host field in HTTP.

http-cookie-generation

Set the generation of HTTP cookies to be accepted. The exact value is not important, only that it is different from any generation that has already been used. Changing this value invalidates all existing cookies.

http-cookie-path

Specify the path to which cookie persistence is limited.

http-cookie-share

Configure to control the sharing of cookies across virtual servers.

Using same-ip means that any cookie generated by one virtual server can be used by another virtual server in the same virtual domain.

Disable stops cookie sharing between virtual servers.

http-ip-header

For HTTP multiplexing, enable or disable to add teh original client IP address in the X-Forwarded-For HTTP header.

http-ip-header-name

For HTTP multiplexing, enter a custom HTTP header name. The original client IP address is added to this header. If empty, X-Forwarded-For is used.

http-multiplex

Enable or disable HTTP multiplexing.

http-redirect

Enable or disable redirection of HTTP to HTTPS.

https-cookie-secure

Enable or disable verification that HTTPS cookies are secure.

id

Enter a unique number as the policy ID, or use the default (0) to automatically assign a policy ID. Policy IDs can be up to a maximum of 9 digits in length. Once a policy ID has been configured it cannot be changed.

ldbd-method

Select the method used to distribute sessions to real servers.

max-embryonic-connections

Set the maximum number of incomplete connections, from 0 to 100000.

monitor

Select the health check monitor to use when polling to determine a virtual server's connectivity status.

nat-source-vip

Enable or disable forcing the source NAT mapped IP to the external IP for all traffic.

nat44

Enable or disable NAT44.

This option is not available for IPv6 policies.

nat46

Enable or disable NAT46.

This option is not available for IPv6 policies.

nat64

Enable or disable NAT64.

This option is only available for IPv6 policies.

nat66

Enable or disable NAT66.

This option is only available for IPv6 policies.

outlook-web-access

Enable to add the Front-End-Https header for Microsoft Outlook Web Access.

persistence

Configure the method used to ensure that clients connect to the same server every time they make a request that is part of the same session.

portmapping-type

Select the port mapping type, either 1-to-1 or m-to-n (many to many).

This option is not available for IPv6 policies.

server-type

Select the protocol to be load balanced by the virtual server (also called the server load balance virtual IP).

ssl-accept-ffdhe-groups

Enable or disable using the FFDHE cipher suite for SSL key exchange.

ssl-algorithm

Set the permitted encryption algorithms for SSL sessions according to encryption strength:

• high: permit only high encryption algorithms: AES or 3DES.
• medium: permit high or medium (RC4) algorithms.
• low: permit high, medium, or low (DES) algorithms.
• custom: only allow some preselected cipher suites to be used.

ssl-certificate

Select the certificate to use for SSL handshake.

ssl-client-fallback

Enable or disable support for preventing downgrade attacks on client connections.

ssl-client-rekey-count

Set the maximum length of data in MB before triggering a client rekey. Set to 0 to disable.

ssl-client-renegotiation

Select the SSL secure renegotiation policy.

• allow: allow, but do not require secure renegotiation.
• deny: do not allow renegotiation.
• secure: require secure renegotiation.

ssl-client-session-state-max

Set the maximum number of SSL session states to keep between the client and FortiGate, from 0 to 100000.

ssl-client-session-state-timeout

Set the number of minutes to keep the SSL session states between the client and FortiGate, from 1 to 14400.

ssl-client-session-state-type

Select the method to use to expire SSL sessions between the client and FortiGate.

• both: expire SSL session states when either ssl-client-session-state-max or ssl-client-session-state-timeout is exceeded, regardless of which occurs first.
• count: expire SSL session states when ssl-client-session-state-max is exceeded.
• disable: expire all SSL session states.
• time: expire SSL session states when ssl-client-session-state-timeout is exceeded.

ssl-dh-bits

Select the number of bits used in the Diffie-Hellman exchange for RSA encryption of the SSL connection: 768, 1024, 1536, 2048, 3072, or 4096.

ssl-hpkp

Enable or disable including HPKP header in the response.

ssl-hpkp-age

Set the number of seconds that the client should honor the HPKP setting (60 - 157680000).

ssl-hpkp-backup

Select the certificate used to generate the backup HPKP pin from.

ssl-hpkp-include-subdomains

Enable or disable indicating that the HPKP header applies to all subdomains.

ssl-hpkp-primary

Select the certificate used to generate the primary HPKP pin from.

ssl-hpkp-report-uri

Set the URL to report HPKP violations to (maximum size = 255).

ssl-hsts

Enable or disable including HSTS header in response.

ssl-hsts-age

Set the number of seconds that the client should honour the HSTS setting (60 - 157680000).

ssl-hsts-include-subdomains

Enable or disable indicating that the HSTS header applies to all subdomains.

ssl-http-location-conversion

Enable to replace HTTP with HTTPS in the reply’s Location HTTP header field.

ssl-http-match-host

Enable or disable HTTP host matching for location conversion.

ssl-max-version

Select the highest version of SSL/TLS to allow in SSL sessions: ssl-3.0, tls-1.0, tls-1.1, tls-1.2, or tls-1.3.

ssl-min-version

Select the lowest version of SSL/TLS to allow in SSL sessions: ssl-3.0, tls-1.0, tls-1.1, tls-1.2, or tls-1.3.

ssl-mode

Select the method to use for SSL offloading between the client and FortiGate (half) or from the client to FortiGate and from FortiGate to the server (full).

ssl-pfs

Select the cipher suites that can be used for SSL perfect forward secrecy (PFS):

• allow: allow use of any cipher suite so PFS may or may not be used depending on the cipher suite selected.
• deny: allow only non-Diffie-Hellman cipher suites, so PFS is not applied.
• require: allow only Diffie-Hellman cipher suites, so PFS is applied.

This setting applies to both client and server sessions.

ssl-send-empty-frags

Enable or disable sending empty fragments to avoid CBC IV attacks (SSL 3.0 and TLS 1.0 only).

This setting may need to be disabled for compatibility with older systems.

ssl-server-algorithm

Set the permitted encryption algorithms for SSL server sessions according to encryption strength:

• high: permit only high encryption algorithms: AES or 3DES.
• medium: permit high or medium (RC4) algorithms.
• low: permit high, medium, or low (DES) algorithms.
• custom: only allow some preselected cipher suites to be used.
• client: Use the same encruption algorithms for both client and server sessions.

ssl-server-max-version

Select the highest version of SSL/TLS to allow in SSL server sessions: client, ssl-3.0, tls-1.0, tls-1.1, tls-1.2, or tls-1.3.

ssl-server-min-version

Select the lowest version of SSL/TLS to allow in SSL server sessions: client, ssl-3.0, tls-1.0, tls-1.1, tls-1.2, or tls-1.3.

ssl-server-session-state-max

Set the maximum number of FortiGate to server SSL session states to keep, from 0 to 100000.

ssl-server-session-state-timeout

Set the number of minutes to keep FortiGate to server SSL session states, from 1 to 14400.

ssl-server-session-state-type

Select the method to use to expire FortiGate to server SSL sessions:

• both: expire SSL session states when either ssl-client-session-state-max or ssl-client-session-state-timeout is exceeded, regardless of which occurs first.
• count: expire SSL session states when ssl-client-session-state-max is exceeded.
• disable: expire all SSL session states.
• time: expire SSL session states when ssl-client-session-state-timeout is exceeded.

uuid

Enter the universally unique identifier (UUID). This value is automatically assigned but can be manually reset.

weblogic-server

Enable or disable adding an HTTP header to indicate SSL offloading for a WebLogic server.