Skip to main content
JimBo
JimBo
Explorer
November 19, 2023
Solved

FortiGate Web Application Firewall (WAF) configuration and troubleshooting

  • November 19, 2023
  • 3 replies
  • 28634 views

Hi guys,

 

Hoping to find Fortigate WAF configuration and troubleshooting help.

 

I see the Fortigate docs provide bits and peices of this WAF technology for FortiGate firewall (mostly just scratch the surface), Youtube videos provide a little bit more info and I can sort of set it up and assign WAF policy to an active security policy but what's next? Is there a way to verify configuration, traffic flows, detection of hacks, logging, which WAF features should be enabled and for what reason, how to troubleshoot and etc.

 

We are currently use FortiOS 7.0.12 and don't have the FortiWeb appliance.

 

Thanks for any assistance

Jimmy

Best answer by pminarik

The WAF signatures aren't really maintained anymore, so it's hard to say how well the individual default signatures are expected to work.

The WAF profile should certainly work for method (GET/POST/...) and path (/some/where/to/access) restrictions, but beyond that you need to be careful.

 

Combining with IPS may help (as seen with IPS blocking the injection previously;)), but the typical recommendation as far as I can see is to use a dedicated WAF appliance, e.g. FortiWeb.

3 replies

AEK
SuperUser
AEK
SuperUser
November 19, 2023

Hello

  • The way to verify the configuration: Try access your Web server through through FGT
  • Check traffic flows: Enable logging in your policy, and check logs in Log & Report > Forward Traffic
  • Detection of hacks: Go to Log & Report > Web Application Firewall
  • WAF features to enable: Use default profile, then tune if needed, e.g.: disable some signatures if you have false positives
AEK
    Rajan_kohli
    Staff
    Rajan_kohli
    Staff
    November 19, 2023

    Hi @JimBo 

     

    You can use this link for configuration of WAF: https://docs.fortinet.com/document/fortigate/7.4.1/administration-guide/491256/protecting-a-server-running-web-applications

     

    For troubleshooting logs issue: https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-How-to-investigate-if-WAF-is-not-generating/ta-p/196635

     

    Regards

    Rajan

      JimBo
      JimBoAuthor
      Explorer
      November 20, 2023

      Hi guys, 

      I have my border fw setup and passing traffic. I see traffic reaching my border firewall and being passed to my server (another FortiGate used to simulate a web server). Log & Report, Forward Traffic shows Allowed and Blocked traffic as expected. Once our web server is installed, I'll add it in-line for public access but for now just trying to understand the ins and outs of this WAF technology before I expose it to the world.

       

      The 1st url link shows how to test the WAF with invalid traffic - When I run the example script http://<IP>/index.php?username=1'%20or%20'1'%20=%20'1&password=1'%20or%20'1'%20= %20'1,  I receive SQL Injection error messages under Log & Report, Intrusion Prevention but not under the Web Application Firewall. I guess an error message is good no matter where it shows up. I can run this command multiple times to produce the error message.

       

      The second url link show how to enable logging under the WAF configuration and nothing shows up yet ... I'll keep an eye on this one.

       

      I'm new to the WAF and I guess there would be some technical discussions surrounding this technology.

      Thanks for sharing, and if you have more, PLEASE pass it along!!!!!

      pminarik
      Staff
      pminarik
      Staff
      November 21, 2023

      That means the "attack" was detected and blocked by IPS inspection, not by WAF.

      If you have both IPS and WAF enabled in a policy, that's expected, since IPS (via IPS engine) is applied first, WAF (and other proxy-mode inspection profiles) only afterwards.

      ref: https://docs.fortinet.com/document/fortigate/6.4.0/parallel-path-processing-life-of-a-packet/200486/utm-ngfw-packet-flow-proxy-based-inspection

       

      If your goal is to specifically test and observe WAF's behaviour, remove the IPS profile from the firewall policy and keep only WAF in it (+the relevant SSL inspection profile, of course).

        Terms & ConditionsAccessibility statement