Technical Tip: View WAF signature details with WAF’s event ID

Description

This article describes the procedure to identify the reason why traffic to specific URLs was blocked by WAF signatures when there is an event ID shown in Web Application Firewall logs as below and how to View WAF signature details with WAF’s event ID.

Scope

FortiGate.

Solution

The command below can be executed in CLI to check on signature details based on Web Application Firewall Event ID:

diag waf dump | grep –f 90300017

Note:

The CLI command 'diagnose waf dump' lists all the WAF signatures in FortiOS. It is only visible in CLI using this command, and not in the GUI.