This article assumes that an inline CASB profile, proxy-based inspection, and a full SSL inspection profile are configured. For configuring inline CASB and example configuration see: Inline CASB.
In this example, the SaaS application Gmail is configured with the user activity upload-local-file configured to block.
The purpose of this user activity is to block file attachments to Gmail emails. The result should show that the file attachment failed.
If the file is not being blocked, first check the Inline CASB security event logs. This can be found in the FortiOS GUI under Log & report -> Security Events -> Inline-CASB. Check that the correct action is taken.
GUI log example:
Raw log example:
date=2026-09-02 time=07:31:40 eventtime=1788359500503486416 tz="-0700" logid="2500010000" type="utm" subtype="casb" eventtype="casb" level="warning" vd="root" policyid=1 poluuid="cd238d58-a0c2-51f1-df58-6e00ebbb4bfc" policytype="policy" sessionid=4856 srcip=10.104.0.100 dstip=142.250.137.18 srcport=60524 dstport=443 srcintf="port2" srcintfrole="undefined" srcuuid="92bdd804-a085-51f1-e751-7ef8f6cc624f" dstintf="port1" dstintfrole="undefined" dstuuid="92bdd804-a085-51f1-e751-7ef8f6cc624f" proto=6 url="https://mail.google.com/_/upload?authuser=0&dcp=asu-n" action="block" profile="Google" saasapp="google-gmail" useractivity="google-gmail-upload-local-file" activitycategory="activity-control" msg="CASB access was blocked because it contained banned activity."
The log shows that the action was 'block', the URL was 'https://mail.google.com/_/upload?authuser=0&dcp=asu-n', the SaaS application was 'google-gmail', the specific user activity was 'google-gmail-upload-local-file', and the reason for the block was 'CASB access was blocked because it contained banned activity'.
If no log is generated or an unexpected action is applied, collect WAD debug output to review how the SaaS application is identified and processed by CASB.
To run the WAD debug (replace x.x.x.x with the source IP of the test client):
diagnose debug console timestamp enable
diagnose wad debug enable category http
diagnose wad debug enable category casb
diagnose wad debug display pid enable
diagnose wad debug enable level verbose
diagnose wad filter src x.x.x.x
diagnose wad debug show
diagnose wad filter list
diagnose debug enable
To stop debugging:
diagnose wad debug clear
diagnose wad filter clear
diagnose debug disable
diagnose debug reset
To verify the HTTP POST request headers in the WAD debug output, review entries similar to the partial example shown below:
POST /_/upload?authuser=0&dcp=asu-n HTTP/1.1
Host: mail.google.com
content-length: 80
sec-ch-ua-full-version-list: "Not=A?Brand";v="99.0.0.0", "Google Chrome";v="151.0.7922.174", "Chromium";v="151.0.7922.174"
sec-ch-ua-platform: "Windows"
sec-ch-ua: "Not=A?Brand";v="99", "Google Chrome";v="151", "Chromium";v="151"
sec-ch-ua-bitness: "64"
sec-ch-ua-model: ""
sec-ch-ua-mobile: ?0
sec-ch-ua-form-factors: "Desktop"
sec-ch-ua-wow64: ?0
x-goog-upload-protocol: resumable
sec-ch-ua-arch: "x86"
x-goog-upload-file-name: upload-test.txt
sec-ch-ua-full-version: "151.0.7922.174"
content-type: application/x-www-form-urlencoded;charset=UTF-8
x-goog-upload-header-content-type: text/plain
x-goog-upload-header-content-length: 22
x-goog-metadata-proto-format: b
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36
x-goog-upload-command: start
sec-ch-ua-platform-version: "15.0.0"
accept: */*
origin: https://mail.google.com
x-browser-channel: stable
x-browser-year: 2026
x-browser-validation: 1np4czHTgmmEnZuHzsr7dj6pNow=
x-browser-copyright: Copyright 2026 Google LLC. All Rights Reserved.
x-client-data: CKmdygEIk6HLAQiFoM0BCK3flDAI7d+UMAiX4pQwGKnYlDAYqN6UMBis35Qw
sec-fetch-site: same-origin
sec-fetch-mode: cors
sec-fetch-dest: empty
referer: https://mail.google.com/mail/u/0/?service=mail&flowName=GlifWebSignIn&flowEntry=AccountChooser&ec=asw-gmail-globalnav-signin
The example shows that the host is 'mail.gmail.com', the POST request is '/_/upload?authuser=0&dcp=asu-n HTTP/1.1', and the filename is 'upload-test.txt'.
Check how WAD processed this HTTP post:
[V]2026-09-02 07:31:40.503079 [p:2146][s:4856][r:766] wad_http_marker_uri :1270 path=/_/upload len=9
[V]2026-09-02 07:31:40.503092 [p:2146][s:4856][r:766] wad_http_parse_host :1649 host_len=15
[I]2026-09-02 07:31:40.503101 [p:2146][s:4856][r:766] wad_http_parse_host :1681 host=[15]mail.google.com
[I]2026-09-02 07:31:40.503113 [p:2146][s:4856][r:766] wad_http_str_canonicalize :2196 enc=0 path=/_/upload len=9 changes=0
[I]2026-09-02 07:31:40.503122 [p:2146][s:4856][r:766] wad_http_str_canonicalize :2198 end=4 path=authuser=0&dcp=asu-n len=20 changes=0
[V]2026-09-02 07:31:40.503130 [p:2146][s:4856][r:766] wad_http_normalize_uri :2570 host_len=15 path_len=9 query_len=20
[I]2026-09-02 07:31:40.503141 [p:2146][s:4856][r:766] wad_http_req_detect_special :16175 captive_portal detected: false, preflight=(null)
[V]2026-09-02 07:31:40.503152 [p:2146][s:4856][r:766] wad_http_req_exec_act :14651 dst_addr_type=1 wc_nontp=0 sec_web=1 web_cache=0 req_bypass=1
[I]2026-09-02 07:31:40.503230 [p:2146][s:4856][r:766] wad_http_srv_attach_req :841 [0x7fb9f440f308] Use old server0x7fb9f41288f8: :0
[V]2026-09-02 07:31:40.503241 [p:2146][s:4856][r:766] wad_http_req_get_svr :9548 http session 0x7fb9f4bdbf98 req=0x7fb9f440f308 connected
[V]2026-09-02 07:31:40.503250 [p:2146][s:4856][r:766] wad_http_msg_start_setup_proc :2251 msg(0x7fb9f440f308) proc-setup started from: req_casb.
[V]2026-09-02 07:31:40.503258 [p:2146][s:4856][r:766] wad_http_def_proc_msg_plan :2213 msg(0x7fb9f440f308) setting up processor(req_casb)
[V]2026-09-02 07:31:40.503275 [p:2146][s:4856][r:766] wad_casb_profile_match_app_by_host:1058 Hit casb_app:0x7fb9efa9ed70 name:google-gmail
[V]2026-09-02 07:31:40.503285 [p:2146][s:4856][r:766] wad_http_casb_proc_alloc :50 casb:0x7fb9f4eca0f0 added msg:0x7fb9f440f308
[I]2026-09-02 07:31:40.503295 [p:2146][s:4856][r:766] wad_http_req_setup_casb :169 casb_proc:0x7fb9f4eca0f0 added, profile:Google
[V]2026-09-02 07:31:40.503303 [p:2146][s:4856][r:766] wad_casb_prof_app_proc_header :991 App:google-gmail is processing msg:0x7fb9f440f308 header.
[V]2026-09-02 07:31:40.503321 [p:2146][s:4856][r:766] wad_casb_str_matcher_substr_match :380 Substr matched: "/_/upload?authuser=0&dcp=asu-n"
[I]2026-09-02 07:31:40.503330 [p:2146][s:4856][r:766] wad_casb_ua_take_action :884 App:google-gmail UA:google-gmail-upload-local-file is taking action: block.
[I]2026-09-02 07:31:40.503340 [p:2146][s:4856][r:766] __wad_http_build_replmsg_resp :789 Generating replacement message. Google repmsg_id 94
[I]2026-09-02 07:31:40.503458 [p:2146][s:4856][r:766] wad_casb_ua_take_action :899 App:google-gmail UA:google-gmail-upload-local-file action_result:done
[I]2026-09-02 07:31:40.503470 [p:2146][s:4856][r:766] wad_http_parse_referer_hline :4181 referer_len 124
[I]2026-09-02 07:31:40.503739 [p:2146][s:4856][r:766] wad_http_req_proc_drain_body_for_forged_resp:9262 req(0x7fb9f440f308) resp(0x7fb9f4d4bce8)
[V]2026-09-02 07:31:40.503753 [p:2146][s:4856][r:766] wad_http_msg_start_setup_proc :2251 msg(0x7fb9f4d4bce8) proc-setup started from: resp_forward.
[V]2026-09-02 07:31:40.503761 [p:2146][s:4856][r:766] wad_http_def_proc_msg_plan :2213 msg(0x7fb9f4d4bce8) setting up processor(resp_forward)
[I]2026-09-02 07:31:40.503769 [p:2146][s:4856][r:766] wad_dump_fwd_http_resp :2932 hreq=0x7fb9f440f308 Forward response from Internal:
HTTP/1.1 403 Forbidden
Content-Type: text/html
Cache-Control: no-cache
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Content-Security-Policy: frame-ancestors 'self'
Content-Length: 35086
The following lines show the request for CASB processing and that the googl-gmail SaaS application was matched:
wad_casb_profile_match_app_by_host:1058 Hit casb_app:0x7fb9efa9ed70 name:google-gmail
wad_http_casb_proc_alloc :50 casb:0x7fb9f4eca0f0 added msg:0x7fb9f440f308
wad_http_req_setup_casb :169 casb_proc:0x7fb9f4eca0f0 added, profile:Google
The HTTP header is being processed:
wad_casb_prof_app_proc_header :991 App:google-gmail is processing msg:0x7fb9f440f308 header.
wad_casb_str_matcher_substr_match :380 Substr matched: "/_/upload?authuser=0&dcp=asu-n
The action taken was block and a replacement message was generated:
wad_casb_ua_take_action :884 App:google-gmail UA:google-gmail-upload-local-file is taking action: block.
__wad_http_build_replmsg_resp :789 Generating replacement message. Google repmsg_id 94
wad_casb_ua_take_action :899 App:google-gmail UA:google-gmail-upload-local-file action_result:done
Related articles:
| 
