Technical Tip: How to rate limit source IP access to application URL within specified time

[shafiq23]

Description	This article describes how to configure a custom rule in FortiAppSec Cloud WAF to implement URL/API endpoint rate limiting. The goal of this rule is to limit the number of requests from a single client IP within a specified time.
Scope	FortiAppSec Cloud WAF.
Solution	Requirement: Period block source IP exceeds the rate limit within a specified time. Configuration: Go to Advanced Applications -> Custom Rule and select Create Rule. Define the rule name and its operation (action). Select Add Filter to define the match conditions. Source IP: '<IP-range>'. URL: '/sample-URL'. Occurrence: 10 times in 1 minute. Expected result: If there was a violation (11th request) within 1 minute, block the source IP for 60 seconds. To verify the functionality of the custom rule, navigate to Threat Analytics -> Attack Logs and check for logs related to the custom rule name. For more information, refer to the following document: Custom Rule