Description
This article describes the procedure to identify the reason why traffic to specific URLs was blocked by WAF signatures when there is an event ID shown in Web Application Firewall logs as below and how to View WAF signature details with WAF’s event ID.
Scope
FortiGate.
Solution
The command below can be executed in CLI to check on signature details based on Web Application Firewall Event ID:
diag waf dump | grep –f 90300017
Note:
The CLI command 'diagnose waf dump' lists all the WAF signatures in FortiOS. It is only visible in CLI using this command, and not in the GUI.
