Technical Tip: How to limit access to specific URL from specific User Agents

[Khidzir_MN]

Description	This article describes how to limit access to specific URLs from specific User Agents. It may be necessary to preconfigure other respective Application setups and refer to the documentation at the end of this article for more information on onboarding the application.
Scope	FortiAppSec Cloud.
Solution	It is necessary to limit access to specific URLs from specific User Agents. For example: There is a requirement to allow access from mobile devices (for example Android, iPhone, and iPad) to access https://www.example.com/abc. The Custom Rule feature may be used for the requirement. Go to ADVANCED APPLICATIONS -> Custom Rule. It may be necessary to enable this module in the '+ ADD MODULES' menu, under ADVANCED APPLICATIONS -> Custom Rule. Select the '+ Create Rule' button on the right. For the Create Custom Rule, enter the respective information. For Name, specify the respective name to identify the rule, and for Operation, select Alert & Deny. Select the 'ADD FILTER' button on the right. For Filter Type, select HTTP Header and set HTTP Header to ON. Under Header Name, select User-Agent. For the Value Pattern enter 'Mobile|iP(hone|ad)|Android' (without quote). Enable the Reverse Matching option. Select the SAVE FILTER. Select the 'ADD FILTER' button again. For Filter Type, select URL and for URL Pattern, input the respective URL that needs to be allowed access. Select the SAVE FILTER. Select 'OK'. Select 'SAVE' on the Custom Rule page to apply the Custom Rule. Related documents: Application Onboarding Custom Rule