Technical Tip: How to configure URL Access policy to restrict the domain website access and allow specific URLs to public

[kmak]

Description	This article describes how to configure URL Access policy to restrict the domain website access and allow specific URLs to be public.
Scope	FortiWeb.
Solution	Prerequisite: The server policy is applied with the URL Access Policy. The incoming request IP is not Source-NAT or the source IP should be able to be identified via X-Forwarder-For header. Adding an allowed IP in the URL access rule does not prevent the IP from blocking by other WAF modules in FortiWeb. Understand the sequence of scans of FortiWeb to decide if the allowed IP should be added to the URL Access policy or into the IP List: Sequence of scans Navigate to the URL Access page and create a URL Access Rule. The URL Access Rule shall use the action 'Alert & Deny'. In the example, the hostname 'restricted.ft-dev.site' is used. In the URL Access rule, create the URL match pattern using the negate match option 'Object does not match the URL Pattern and Parameters'. Use the Regular Expression URL matching type and insert the URL pattern which excluded from the restriction. After creating the URL Access Rule, proceed to create a URL Access Policy and select the created URL Access rule into the policy. Select the URL Access policy rule in the Web Protection Profile. Test the page browsing to verify the blocking pages and allowed public pages. Go back to the URL Access page and create another URL Access rule that allows specific IP address to access the restricted host. The new rule should use the action 'Pass'. In the URL matching rule, enable the Source Address option and insert the allowed IP address. The wildcard URL matching pattern is used to match all URLs. After creating the URL Access rule, select the rule in the same URL Access Policy. Change the order of the URL Access rule to make sure that the allowed IP access rule is on top of the restriction rule. Once saved, retest the web URL browsing with the different source to verify the access restriction. Related document: Restricting access based on specific URLs