Technical Tip: How to configure a Web Application Firewall (WAF) to protect a web server behind FortiGate

[ManpreetSingh]

Description	This article describes how to configure a Web Application Firewall (WAF) on a FortiGate firewall to protect a web server. It covers enabling the WAF feature, configuring a WAF profile to guard against SQL Injection and Generic Attacks, setting up SSL Inspection with deep inspection and server protection, and applying these security profiles to the relevant firewall policy.
Scope	FortiGate.
Solution	To protect a web server behind the FortiGate using Web Application Firewall (WAF), follow these steps. This configuration requires enabling SSL Inspection with a deep-inspection profile and applying the 'Protecting SSL Server' settings. Step 1: Enable the WAF Feature. The WAF feature is not enabled by default. To enable it: Go to System - Feature Visibility. Under the Security Features section, enable Web Application Firewall (WAF). Step 2: Configure the WAF Profile. Create a new WAF profile or edit the default one to protect against SQL Injection and Generic Attacks. Go to Security Profiles -> Web Application Firewall. Edit the default profile or create a new one. In the profile: Locate the SQL Injection (Extended) and Generic Attacks (Extended) signatures. For each signature: Set Action to Enable. Set Action to Block and Severity to High. Select OK to save the changes.  The values of the constraints can be adjusted based on the security requirements and the specific needs of the web applications.   Step 3: Configure SSL Inspection for Protecting the SSL Server. To protect the web server, modify the deep-inspection profile to use the 'Protecting SSL Server' setting and ensure the correct server certificate is applied. Go to Security Profiles -> SSL/SSH Inspection. Edit the existing deep-inspection profile or create a new one. In the profile: Change the SSL Inspection option to Protecting SSL Server. Under Server Certificate, import and select the certificate of the web server. Note: To upload the web server certificate and troubleshoot refer to these KB articles: Technical Tip: SSL/TLS and the use of Digital Certificates. Troubleshooting Tip: A guide to FortiGate and certificate issues. Troubleshooting Tip: Fixing the error 'Certificate file is duplicated for CA/LOCAL/REMOTE/CRL cert.   Step 4: Apply the Security Profiles to the Firewall Policy. Finally, apply the configured WAF and SSL Inspection profiles to the firewall policy that allows access to the web server. Go to Policy & Objects -> IPv4 Policy. Edit the policy that allows traffic to the web server. Under the Security Profiles section: Enable and select the configured WAF profile. Enable and select the configured SSL Inspection profile. Select OK to save the policy. The FortiGate will effectively protect the web server behind it using the Web Application Firewall and SSL Inspection with deep inspection and server protection settings. Note: If the web service is running on a different port, create a new protocol-option profile on Policy&Objects -> Protocol. Option and modify the HTTP port to the one that is being used in the specific scenario. Then on the relevant policy, choose the new protocol option. It will also be necessary to perform this change on the SSL Inspection profile under Protocol Port Mapping. The port can be added on the HTTPS field using a comma after port 443, or by choosing the Inspect all ports option. Related document: Troubleshooting Tip: How to investigate if WAF is not generating logs for blocked traffic