Custom FortiGate WAF signature act as an exception list - doesn't work
Hi, I'm trying to use custom WAF signatures to implement exceptions as described on the page: https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-create-a-custom-FortiGate-WAF-Web/ta-p/355036
Unfortunately, this method doesn't work for me, yes, the custom rule does work, the logs show that the URL was detected and allowed, but right after this entry the next entry shows that the same URL was blocked by the WAF rule.
The config looks pretty simple:
config waf profile
edit "xxxx"
config custom-signature
edit "allow_search"
set status enable
set log enable
set pattern "search.php"
set target req-uri
next
...
I want to exclude the "search.php" page from WAF protection (always allowed)
The page is blocked despite the existence of this exception. log:
First, there is an entry about the page being blocked:
2025/01/31 10:26:26, blocked, SQL Injection (Extended), 40000137, waf-signature
and then:
2025/01/31 10:26:26, passthrough, , , waf-custom-signature
In both cases, the same URL containing "search.php"
Does anyone use these exceptions and does it work for anyone?
Or maybe someone knows how to do it differently?
Fortigate 70F, 7.4.7
