waf geo-block-list

Use this command to define large sets of client IP addresses to block based upon their associated geographical location.

Because network mappings may change as networks grow and shrink, if you use this feature, be sure to periodically update the geography-to-IP mapping database. To download the file, go to the Fortinet Customer Service & Support website:

https://support.fortinet.com

Optionally, you can also specify a list of IP addresses or IP address ranges that are exempt from this blacklist. For details, see waf geo-ip-except.

Alternatively, you can block clients individually (see "server-policy custom-application application-policy" on page 1) or based upon their reputation (see waf ip-intelligence-ignore-x-forwarded-for).

To apply the rule, select it in a protection profile. For details, see waf web-protection-profile inline-protection or waf web-protection-profile offline-protection.

To use this command, your administrator account’s access control profile must have either w or rw permission to the wafgrp area. For details, see Permissions.

Syntax

config waf geo-block-list

edit "<geography-to-ip_name>"

set severity {High | Medium | Low | Info}

set action { alert_deny | block-period | deny_no_log}

set block-period <block_period_int>

set exception-rule <datasource>

set trigger "<trigger-policy_name>"

set ignore-x-forwarded-for {enable | disable}

set mode {allow | block}

config country-list

edit <entry_index>

set country-name "<region_name>"

end

Variable	Description	Default
"<geography-to-ip_name>"	Enter the name of a new or existing rule. The maximum length is 63 characters. To display the list of existing rules, enter: `edit ?`	No default.
severity {High \| Medium \| Low \| Info}	Select the severity level to use in logs and reports generated when a violation of the rule occurs.	`Low`
action { alert_deny \| block-period \| deny_no_log}	Select which action FortiWeb will take when it detects a violation of the rule: `alert_deny`—Block the request (or reset the connection) and generate an alert and/or log message. `deny_no_log`—Block the request (or reset the connection). `block-period`—Block subsequent requests from the client for a number of seconds. Also configure `block-period`. Note: This setting will be ignored if monitor-mode {enable \| disable} is enabled in a server policy.	block-period
block-period <block_period_int>	Enter the number of seconds that you want to block subsequent requests from a client after FortiWeb detects that the client has violated the rule. The valid range is 1–3,600 seconds. This setting is available only if `Action` is set to `block-period`.	`60`
exception-rule <datasource>	The exception parameter allows administrators to override Geo-IP filtering rules by specifying individual IP addresses that should be treated differently from the default regional access policy. The effect of these exceptions varies depending on whether allow or block is selected in mode {allow \| block}. In Allow Mode, if an IP is from an allowed region but is also in the exception list, it is denied, overriding the allow rule for that region. In Block Mode, If an IP is from a blocked region but is also in the exception list, it is allowed, overriding the block rule for that region.	No default.
trigger "<trigger-policy_name>"	Enter the name of the trigger to apply when this rule is violated. For details, see log trigger-policy. The maximum length is 63 characters. To display the list of existing trigger policies, enter: `set trigger ?`	No default.
ignore-x-forwarded-for {enable \| disable}	By default, FortiWeb scans the IP addresses in the X-Forwarded-For header at the HTTP layer. This causes high resource consumption. To enhance the performance, you can enable Ignore X-Forwarded-For so that the IP addresses can be scanned at the TCP layer instead. This avoids HTTP packets being processed unnecessarily.	disable
mode {allow \| block}	The mode parameter controls how FortiWeb enforces Geo-IP filtering rules. It determines whether access is managed through an allow-list approach (permitting only specified regions) or a block-list approach (denying only specified regions). allow (Deny by default, allow only specified regions): All incoming traffic is denied unless the source IP matches a region specified in the allow-list. If an IP address originates from an allowed region, it is permitted unless it also matches an entry in the exception list (exception-rule <datasource>), in which case it is blocked. This mode is useful for environments that need to strictly limit access to a predefined set of trusted locations. block (Allow by default, block only specified regions): All incoming traffic is allowed unless the source IP matches a region specified in the block-list. If an IP address originates from a blocked region, it is denied unless it also matches an entry in the exception list (exception-rule <datasource>), in which case it is allowed. This mode is suitable when access should be open to most locations while restricting only known high-risk regions.	block
<entry_index>	Enter the index number of the individual entry in the table. The valid range is 1–9,999,999,999,999,999,999.	No default.
country-name "<region_name>"	Enter the name of a region (`Antarctica` or `Bouvet Island`) or country (`U.S.`) as it is written in English. Surround names with multiple words or apostrophes in double quotes. The list of locations varies by the currently installed IP-to-geography mapping package. For a current list of locations, use the web UI.	No default.

Example

This example creates a set of North American IP addresses that a server policy can use to block clients with IP addresses belonging to Belize and Canada. FortiWeb does not block the IP addresses specified by the allow-north-america exception list.

config waf geo-block-list

edit "north-america"

set trigger "notification-servers1"

set exception rule "allow-north-america"

set severity Low

config country-list

edit 1

set country-name "Belize"

edit 2

set country-name "Canada"

end