Technical Tip: How to debug the FortiWeb URL Rewriting module using CLI debug commands in v7.4.x or later

Prerequisite:

Server Policy Web Protection Profile has the URL Rewriting module enabled.

The FortiWeb URL Rewriting module mostly relies on the HTTP Host and URL regular expression conditions matching.

The FortiWeb GUI traffic log may not be able to identify if the URL rewriting rule and policy match.

Since v7.4.x or later, the CLI debugging has improved and helps better with the URL Rewriting module troubleshooting.

To enable debugging for the URL Rewriting module, run the debug commands below:

diagnose debug timestamp enable
diagnose debug flow filter client-ip X.X.X.X <----- Replace with test client IP.

diagnose debug flow filter server-ip x.x.x.x <----- Replace with test server VIP IP.
diagnose debug flow filter module url-rewriting 7
diagnose debug flow trace start
diagnose debug enable

Send the URL test request.

diagnose debug flow trace stop
diagnose debug disable

Sample 1:

URL Rewriting rule that performs redirection of the URI in the root directory to a subdirectory (/public).

Debugging output:

Sample 2:

URL Rewriting rule that performs redirection of the HTTP URL to the HTTPS URL.

Debugging output:

Related documents:

Rewriting & redirecting