Configuration doubt

[JohnAgora]

Is there a way to configure FortiWeb to protect all my servers and apps with only one policy (and using one profile)?

I want a simple and fast deployment. Eventually I may improve the level of security, but I want an easy start.

Thanks! 

[jwhite_FTNT]

Yes you can always reuse the same protection profile for all of your Server Policies, but then you loose granular controls over the applications.

If deployed in Reverse Proxy mode and you are looking to consolidate everything into one server policy, use content routing .  The feature allows you use a single VIP and route to different backend application servers based on hostname and/or URL path.  Then you can select the same protection profile for each of you content routing rules.

Jim White

[FranHoek]

You dont need to use Content Routing to reuse policies, although I like them more and more and use them now whenever i can.

With content routing you can use different Web Protection Profiles per Content Routing Policy (as in version 5.7 for sure), or the same Web Protection Profiles. Your choice.

Disadvantages:
1 - When you put the Server Policy in : "Monitor Mode" it applies to all websites that are in the Content Routing Server Policy.
2 - Certificates. Only one option to put a Certificate on the Server Policy.
When you have several HTTPS serverd (which is almost sure these days). You need to use a Wildcard certificate or  a multiple domain certificate.

Franklin.

[jwhite_FTNT · Accepted solution]

This list Disadvantage is not accurate: Certificates. Only one option to put a Certificate on the Server Policy.
When you have several HTTPS serverd (which is almost sure these days). You need to use a Wildcard certificate or a multiple domain certificate.

You can use SNI to support multiple certificates.

Jim
207-251-2155

Sent from my phone

On Feb 24, 2017 5:38 AM, "Franklin Hoek via waf.pub" wrote:

You dont need to use Content Routing to reuse policies, although I like them more and more and use them now whenever i can.

With content routing you can use different Web Protection Profiles per Content Routing Policy (as in version 5.7 for sure), or the same Web Protection Profiles. Your choice.

Disadvantages:
1 - When you put the Server Policy in : "Monitor Mode" it applies to all websites that are in the Content Routing Server Policy.
2 - Certificates. Only one option to put a Certificate on the Server Policy.
When you have several HTTPS serverd (which is almost sure these days). You need to use a Wildcard certificate or a multiple domain certificate.

Franklin.

-----End Original Message-----

[FranHoek]

Correct Jim, thats what I meant.