Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
JimBo
New Contributor II

FortiGate Web Application Firewall (WAF) configuration and troubleshooting

Hi guys,

 

Hoping to find Fortigate WAF configuration and troubleshooting help.

 

I see the Fortigate docs provide bits and peices of this WAF technology for FortiGate firewall (mostly just scratch the surface), Youtube videos provide a little bit more info and I can sort of set it up and assign WAF policy to an active security policy but what's next? Is there a way to verify configuration, traffic flows, detection of hacks, logging, which WAF features should be enabled and for what reason, how to troubleshoot and etc.

 

We are currently use FortiOS 7.0.12 and don't have the FortiWeb appliance.

 

Thanks for any assistance

Jimmy

Thank You JimBo
Thank You JimBo
2 Solutions
pminarik

The WAF signatures aren't really maintained anymore, so it's hard to say how well the individual default signatures are expected to work.

The WAF profile should certainly work for method (GET/POST/...) and path (/some/where/to/access) restrictions, but beyond that you need to be careful.

 

Combining with IPS may help (as seen with IPS blocking the injection previously;)), but the typical recommendation as far as I can see is to use a dedicated WAF appliance, e.g. FortiWeb.

[ corrections always welcome ]

View solution in original post

7 REPLIES 7
AEK
Honored Contributor

Hello

  • The way to verify the configuration: Try access your Web server through through FGT
  • Check traffic flows: Enable logging in your policy, and check logs in Log & Report > Forward Traffic
  • Detection of hacks: Go to Log & Report > Web Application Firewall
  • WAF features to enable: Use default profile, then tune if needed, e.g.: disable some signatures if you have false positives
AEK
AEK
Rajan_kohli
Staff
Staff
JimBo
New Contributor II

Hi guys, 

I have my border fw setup and passing traffic. I see traffic reaching my border firewall and being passed to my server (another FortiGate used to simulate a web server). Log & Report, Forward Traffic shows Allowed and Blocked traffic as expected. Once our web server is installed, I'll add it in-line for public access but for now just trying to understand the ins and outs of this WAF technology before I expose it to the world.

 

The 1st url link shows how to test the WAF with invalid traffic - When I run the example script http://<IP>/index.php?username=1'%20or%20'1'%20=%20'1&password=1'%20or%20'1'%20= %20'1,  I receive SQL Injection error messages under Log & Report, Intrusion Prevention but not under the Web Application Firewall. I guess an error message is good no matter where it shows up. I can run this command multiple times to produce the error message.

 

The second url link show how to enable logging under the WAF configuration and nothing shows up yet ... I'll keep an eye on this one.

 

I'm new to the WAF and I guess there would be some technical discussions surrounding this technology.

Thanks for sharing, and if you have more, PLEASE pass it along!!!!!

Thank You JimBo
Thank You JimBo
pminarik

That means the "attack" was detected and blocked by IPS inspection, not by WAF.

If you have both IPS and WAF enabled in a policy, that's expected, since IPS (via IPS engine) is applied first, WAF (and other proxy-mode inspection profiles) only afterwards.

ref: https://docs.fortinet.com/document/fortigate/6.4.0/parallel-path-processing-life-of-a-packet/200486/...

 

If your goal is to specifically test and observe WAF's behaviour, remove the IPS profile from the firewall policy and keep only WAF in it (+the relevant SSL inspection profile, of course).

[ corrections always welcome ]
JimBo
New Contributor II

I removed all of the Security Profiles from the Security Policy - (AntiVirus, Web Filter, Video filter, DNS filter, Application Control, IPS, File filter) and only have Web Application Firewall (default) and SSL inspection (not removable) enabled. I can reach the web server across the Internet just fine. Log & Report, Forward Traffic shows this traffic as successful as expected.

 

When I run the example hack URL (http and/or https)

https://<ip>/index.php?username=1'%20or%20'1'%20=%20'1&password=1'%20or%20'1'%20=%20'1

Log & Report, Forward Traffic sometimes shows this traffic as "TCP reset from client" and other times it seems to allow the traffic through, but no traffic shows up in the Log & Report, Web Application Firewall section which is strange because I also enabled logging in the cli WAF profile as described in this url.

 

For troubleshooting logs issue:

https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-How-to-investigate-if-WAF-is-not-gen...

 

Any additional thoughts?

Thank you

Thank You JimBo
Thank You JimBo
pminarik

The WAF signatures aren't really maintained anymore, so it's hard to say how well the individual default signatures are expected to work.

The WAF profile should certainly work for method (GET/POST/...) and path (/some/where/to/access) restrictions, but beyond that you need to be careful.

 

Combining with IPS may help (as seen with IPS blocking the injection previously;)), but the typical recommendation as far as I can see is to use a dedicated WAF appliance, e.g. FortiWeb.

[ corrections always welcome ]
JimBo
New Contributor II

Thank you guys for all your assistance.

 

I finally figured out how to get the WAF logging operational and most of my valid traffic to the internal server was flagged as invalid with an orange severity level but allowed to pass or flagged as SQL Injection and blocked. Apparently, my newer browsers (Chrome and Safari) ask or offer more than the older WAF signatures understand (I'm guessing). The trick to get logging working within the WAF logging section was to map the external/internal destination ports correctly. Duh.

 

I did confirm with FortiNet support that the WAF signatures are indeed no longer supported on the FortiGate setup to support the WAF feature. The FortiGate WAF does operate at some level and could be used as a test lab to gain familiarity but probably not for real protection.

 

Thanks again.

Thank You JimBo
Thank You JimBo
Top Kudoed Authors