WAF and Load balancer cascaded for Web servers

[Mohamed_Gaber]

We have a problem with WAF and Load balancer cascaded for Web servers. The Apache Tomcat web servers reply with a redirect status code 302 with the location field containing the URL configured in it.

I need to know:

- The WAF modifies which levels or places of the packet.

- The Load balancer modifies which levels or places of the packet.

- The URL configured in the web servers should be what? Should I add an entry to the hosts file of it?

Does the HTTP header include a URL or just the IP in the network address?

In this case, do any of the security devices (specially WAF) change the URL to the destination server IP or it does not touch it?

Could I capture the packets on WAF and load balancer to see both the HTTP headers and network IP?

or even in the log.

[Anthony_E]

Hello Mohamed,

Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible.

Thanks,

[Mohamed_Gaber]

I have to core problems I recognized in this problem:

- I don't understand the HTTP protocol well enough.

- I don't understand FortiWeb & FortiADC well enough. Just push them to work. No time to well understand. I feel sorry for that.

[Anthony_E]

Hi Mohamed,

Did you find a solution? We're happy to help or point you to documentation resources if you'd like to learn more about the products.

Regards,

[Mohamed_Gaber]

Thanks and appreciate that.

I need to know the content of the HTTP header and if it includes the URL as entered by the client.

The levels in the packet which be modified by the WAF and load Balancer.

Should the web server be configured by the IP that the WAF sends the packet to?

I don't know how the packet that reaches the web server looks and the server should be configured to work with it.

If there are documents that explain this, I thank you for that.

If I get a direct reply, I thank you for this also.

I need also to capture the packet while it passes through the security devices to monitor the change.

[Anthony_E]

Hello Mohamed,

We will find the documentations needed and will provide it to you :)!

Regards,

[Anthony_E]

Hello Mohamed,

First here some document for helping you:

Creating HTML headers:

https://docs.fortinet.com/document/fortiweb/7.0.4/cli-reference/667138/waf-http-header-security

Packet capture:

https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-Packet-Capture-on-FortiOS-GUI/ta-p/1...

Some administration information about FortiWeb web servers: https://help.fortinet.com/fweb/586/Content/FortiWeb/fortiweb-admin/define_web_servers.htm 

Regards,

[Mohamed_Gaber]

Thanks and appreciated,

I will be most happy the moment I clearly understand these all.

I feel shame for the current state.

[Anthony_E]

Hello Mohamed,

I sincerely hope you will get all the answers you are requesting.

Regards,

[Mohamed_Gaber]

Thanks for your sincere hopes.

As usual, we hardly find the time to read. I have site delivery for systems tested in the office one year ago then moved to sites. We have several problems including hardware problems.

I did packet capture. But I was not able to find the required.

The FortiWeb traffic log was better.

It included HTTP Host and URL. The URL does not include the IP or the server name. It includes the target data.

It was like this:

Original Source 10.33.6.101
Original Source Country or Region Reserved
Service https/tls1.2
HTTP Version 1.x
Method post
HTTP Host geoportal.gis.local
URL /IDMSCataloguerService/api/RolePrivilage/GetRolePrivilages
Return Code 200
Connection
10.33.6.101:55313 -> 10.33.5.12:443

Original Source 10.33.6.101
Original Source Country or Region Reserved
Service https/tls1.2
HTTP Version 1.x
Method get
HTTP Host geoportal.gis.local
URL /IDMSCataloguerService/api/Test
Return Code 200
Connection
10.33.6.101:55312 -> 10.33.5.12:443

As I understand from this, there are several headers. This includes "Host" and "URL".

I am not sure If I am correct or not.