- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Limit Access to an internal website in Fortigate
I have an internal application to which i want to limit the sessions from a particular source IP.. i.e. an IP should not be able to stablish more than 10 sessions to that application..i understand i can create a threshold for this in IPv4 DOS Policy but the source IP is part of a header.. is it possible to limit sessions based on the source IP contained in the header ?
- Labels:
-
FortiGate
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I don't know such feature on FortiGate. But probably it exists on FortiWeb.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
i also have a fortiweb behing the fortigate.. is it possible to do so in fortiweb ?
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
After double-check yes you can do it with FortiWeb.
Here's a video from video.fortinet.com that explains how FWB can read the IP from the header (X-Forwarded-For) and block it if it is from specific GeoIP.
The trick is to enable "Use X-Header to identify original client's IP" in your X-Forwarded-For rule.
Hope it helps.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi @lostboy10 ,
I don't think that FortiGate can do it. At least, I am not aware of it.
Jerry
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello,
To limit sessions to an internal website based on the source IP contained in the header in FortiGate, you can utilize the Traffic Shaper feature. Within the Traffic Shaper policy settings, set the maximum concurrent connections to 10 for the source IP you want to limit.
Reference Document: https://community.fortinet.com/t5/FortiGate/Technical-Tip-Limit-connections-to-a-specific-destinatio...
Regards!
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
thx for the link.. the source ip in the traffic shaper policy will be of the source ip visible in the header or the one which shows in traffic logs ?
