| Overview. When configuring an IP list in FortiWeb, administrators often use a combination of: - Block IP (Deny IPs).
- Trust IP (exempt from any further scans).
- Allow Only (Whitelist for further scans).
Understanding the evaluation order of these lists is critical to avoid unintended traffic blocking. Behavior and processing order. FortiWeb evaluates incoming traffic against IP lists in the following sequence: - Blocklist (Deny IPs).
- Trust IP.
- Allow only.
Key explanation. - When a request is received, FortiWeb first checks whether the source IP exists in the Blocklist.
- If a match is found, the request is immediately denied, and no further checks are performed.
- Only if the IP is not in the Blocklist, FortiWeb proceeds to evaluate:
Important consideration. If there is any overlap between IP addresses in the Blocklist and: - Trust IP list.
- Allow only IP list.
The Blocklist takes precedence, and the traffic will be blocked. Example scenario: Subnet in Blocklist with Specific IP in Trusted/Allow only list. User configures the following in FortiWeb: - Blocklist (Deny IPs): 192.168.1.0/24.
- Trust IP: 192.168.1.50 (or configured under Allow Only IP list).
Traffic Evaluation: A request is received from Source IP 192.168.1.50. - Blocklist check.
- FortiWeb checks whether 192.168.1.50 falls within any blocked range.
- Match found → IP is part of the Blocklist subnet.
- Immediate Action: Traffic is blocked instantly, and no further checks are performed.
- Trust/Allow Only Check (skipped).
- Even though 192.168.1.50 is explicitly configured as a Trust IP or an Allowed IP.
- These rules are never evaluated.
Recommendation: Avoid placing broad subnets (e.g., /24, /16) in the Blocklist if exceptions are required. Summary. - FortiWeb processes IP rules in this strict order: Blocklist → Trust IP → Allow Only IP.
- Blocklist evaluation happens first, and any match results in an immediate block.
- Even if an IP is explicitly trusted or allowed, it will still be denied if present in the Blocklist.
| 
