I can't find an option to select WAF profile in policy settings. How ever I can create a new WAF profile from "Security Profiles" > "Web Application Firewall"
Ha! They must have added the WAF to the UTM. I checked one of my 6.4.6 and your are correct. You can make a WAF policy but it does not show up in the firewall policy.
My older 6.0.x does not have the WAF feature (but I have a real WAF -FortiWeb)! Contact support!
I got this fixed, contacted TAC. They said "for using WAF you required proxy inspection to be enabled in the respected policy. (when the inspection mode is set to proxy-based you will be able to see WAF)"
