Administration Guide

• Introduction
• Product knowledge resource
  • Documentation
  • Videos
    • Feature Introduction Videos
    • OWASP Top 10 use case videos
    • How-to Videos
• New Features in 7.6.x releases
  • WAF features
    • DLP Exceptions for Fine-Grained Bypass Control (7.6.4)
    • Enhanced Learning Logic for ML-Based API Protection (7.6.4)
    • SSL stripping detection support in MitB Protection (7.6.3)
    • Biometrics-Based Detection Enhancements (7.6.3)
    • Syntax-Based Detection Enhancements (7.6.3)
    • OpenAPI schema validation enhancement (7.6.3)
    • Support for Zstandard (zstd) Compression (7.6.3)
    • gRPC over HTTP/1 support (7.6.3)
    • Scanning for sensitive data leakage in API endpoints (7.6.1)
    • ML-based API Protection UX design enhancements (7.6.1)
    • Detection of abnormal chunk size with Signature module (7.6.1)
    • JS event check for CSRF requests (7.6.1)
    • HTTP/3 traffic support in more modules (7.6.1)
    • HTTP3 Support (7.6.0)
    • Threat Protection model update (7.6.0)
    • Built-in allowed domains in MiTB protection (7.6.0)
    • AJAX check for cross-site request forgery (CSRF) requests (7.6.0)
    • DoS Protection Exception Policy (7.6.0)
    • Obscuring sensitive data in the gRPC API responses (7.6.0)
    • Known Good Bots subcategories (7.6.0)
    • URL Rewrite enhancements (7.6.0)
    • The "deflate" compression type supported (7.6.0)
    • XFF trust IPs (7.6.0)
    • Customizing waiting room display page (7.6.0)
    • Quarantine IP settings moved to Security Fabric > Fabric Connectors (7.6.0)
    • 500 error page enhancement (7.6.0)
    • Signature scan for uploaded files (7.6.0)
  • Server Objects
    • Wildcard Matching Support for Global Cookie Allow Lists (7.6.4)
    • OCSP-Based client certificate verification (7.6.1)
    • Wildcard domain name in Let's Encrypt certificates (7.6.1)
    • LUA script for content routing (7.6.0)
    • HTTP Content Routing table search function enhancements (7.6.0)
    • Server inheriting health check from server pool in TTP mode (7.6.0)
  • Server Policy
    • Source IP Whitelist for Bypassing Monitor Traffic in TTP Mode (7.6.5)
    • Restrict Weak Signature Algorithms (7.6.4)
    • Threat Weight configuration enhancements (7.6.3)
    • Client certificate verification in FTPS connections (7.6.1)
  • Authentication
    • Microsoft Azure OAuth Support (7.6.3)
    • Password changing when using PAP authentication scheme through RADIUS server (7.6.0)
    • Retrieving LDAP users attributes (7.6.0)
    • Automating the generation of SAML and OAuth login pages (7.6.0)
    • Admin user Single Sign-On with SAML (7.6.0)
  • Network
    • Support for MANA Network in Azure (7.6.3)
    • Warning message upon port exhaustion (7.6.0)
  • System
    • Increased Configuration Maximums for 4000F Platform (7.6.4)
    • Securosys Primus HSM Support (7.6.3)
    • Region-based connectivity for FortiWeb Cloud Sandbox (7.6.3)
    • Enhanced private data protection with TPM encryption (7.6.3)
    • Updated API Gateway configuration object limits (7.6.3)
    • SOCaaS license status visibility in the Dashboard (7.6.3)
    • Expanded cipher support in FIPS-CC mode (7.6.3)
    • Admin certificate signing request (7.6.1)
    • Enhanced system time reliability (7.6.1)
    • Viewing FortiWeb performance data in FortiAnalyzer (7.6.0)
    • Replacement message enhancements (7.6.0)
    • Release tags (7.6.0)
    • Maximum value changes (7.6.1)
  • Log, FortiView, and Debug
    • Server Latency Event Logging (7.6.5)
    • Enhanced OpenAPI Validation Attack Logs with Schema Line Numbers (7.6.4)
    • FortiAnalyzer Cloud Support (7.6.3)
    • Enhanced logging for SNMPv3 authentication failures (7.6.3)
    • Object pool memory leak detection in proxyd (7.6.3)
    • Enhanced CPU and memory monitoring (7.6.3)
    • FortiView Bot Analysis enhancements (7.6.1)
    • Enhanced SNMP trap security (7.6.1)
    • Debug commands enhancements (7.6.1)
    • Troubleshooting High-CPU-cost PCRE pattern matching (7.6.1)
    • IPv6 support for Syslog servers (7.6.1)
    • Traffic log enhancements (7.6.0)
    • SSL error logs (7.6.0)
    • FortiView Original Source (7.6.0)
    • FortiView Log Analysis enhancement (7.6.0)
    • Debug commands enhancements (7.6.0)
    • Displaying configuration in its context (7.6.0)
  • High Availability
    • Enhanced support for deploying high volume active-active HA with a load balancer (7.6.1)
    • FortiWeb Hyper-V HA Cluster with Unicast Heartbeat (7.6.0)
    • Synchronizing health check status in HA mode (7.6.0)
  • Security Fabric
    • STIX/TAXII Support for IP Address Connector (7.6.4)
    • Security Fabric: Automation (7.6.0)
  • Ingress Controller enhancements (7.6.0)
  • Disk expansion (7.6.2)
• Key concepts
  • Key Components of FortiWeb
    • WAF features against OWASP Top 10 risks
    • WAF features against OWASP Top 10 API security risks
    • WAF features against OWASP Top 10 Client-Side security risks
    • WAF features against bot attacks
  • Sequence of scans
  • FortiWeb's role and placement in network topology
  • Operation modes
    • Reverse Proxy mode
      • Traffic flow of Reverse Proxy mode
      • Benefits and limitations of the Reverse Proxy mode
      • Key considerations of network settings in Reverse Proxy mode
    • Transparent modes (TTP and TI)
      • Traffic flow of transparent modes
      • Benefits and limitations of the transparent modes
      • Key considerations of network settings in transparent modes
    • WCCP mode
      • Traffic flow of WCCP mode
      • Benefits and limitations of the WCCP modes
      • Key considerations of network settings in WCCP mode
    • Offline Protection mode
      • Traffic flow of Offline Protection mode
      • Benefits and limitations of the Offline Protection mode
      • Key considerations of network settings in Offline Protection mode
    • Summary
    • Supported features in each operation mode
  • High Availability (HA)
    • Active-Passive HA mode
    • Standard Active-Active HA mode
    • High Volume Active-Active HA mode
  • Solutions for specific web attacks
    • WAF solutions against OWASP Top 10 risks
    • WAF Solutions against OWASP Top 10 API Security Risks
    • WAF solutions against bot attacks
  • IPv6 support
  • HTTP/2 support
  • HTTP sessions & security
  • FortiWeb high availability (HA)
  • Administrative domains (ADOMs)
  • How to use the web UI
  • Shutdown
• How to set up your FortiWeb
  • Workflow
  • Appliance vs. VMware
  • Registering your FortiWeb
  • Supported features in each operation mode
  • Connecting to the web UI or CLI
  • Updating the firmware
  • Changing the “admin” account password
  • Setting the system time & date
  • Setting the operation mode
  • Feature visibility
  • Configuring High Availability (HA) basic settings
    • HA heartbeat & active node election
    • Synchronization
  • Replicating the configuration without FortiWeb HA (external HA)
  • Configuring the network settings
  • Configuring DNS settings
  • Configuring HA settings specifically for active-passive and standard active-active modes
  • Configuring HA settings specifically for high volume active-active mode
  • Defining your web servers & load balancers
    • Defining your protected/allowed HTTP “Host:” header names
    • Defining your web servers
    • Defining your proxies, clients, & X-headers
    • Defining your network services
    • Configuring virtual servers on your FortiWeb
    • Enabling or disabling traffic forwarding to your servers
  • Configuring FortiWeb to receive traffic via WCCP
  • Configuring basic policies
  • Testing your installation
  • Switching out of Offline Protection mode
• Policies
  • How operation mode affects server policy behavior
  • Configuring the global object allow list
  • Configuring the allow list at server policy level
  • Configuring a protection profile for inline topologies
  • Generating a protection profile using scanner reports
  • Configuring a protection profile for an out-of-band topology or asynchronous mode of operation
  • Configuring client management
  • Configuring an HTTP server policy
  • Configuring traffic mirror
  • ADFS Proxy
    • Configuring FortiWeb as an ADFS proxy
    • Configuring a virtual server
    • Creating an ADFS server pool
    • Uploading trusted CA certificates
    • Creating an ADFS server policy
    • Troubleshooting
  • Configuring FTP security
    • Creating an FTP command restriction rule
    • Creating an FTP file check rule
    • Configuring an FTP security inline profile
    • Creating an FTP server pool
    • Creating an FTP server policy
• Secure connections (SSL/TLS)
  • Offloading vs. inspection
  • Supported cipher suites & protocol versions
    • Supported cipher suites - for connections between FortiWeb and the clients
    • Supported cipher suites - for connection between FortiWeb and back-end servers
  • CA certificates
  • How to offload or inspect HTTPS
    • Local certificates
    • Let's Encrypt certificates
    • Using session keys provided by an HSM
    • Using Securosys Primus HSM
    • Generating a certificate signing request
    • Uploading a server certificate
  • Forcing clients to use HTTPS
  • HTTP Public Key Pinning
  • How to apply PKI client authentication (personal certificates)
  • Seamless PKI integration
  • Revoking certificates
  • How to export/back up certificates & private keys
  • How to change FortiWeb's default certificate
  • OCSP-Based certificate revocation check
• Users
  • Authentication styles
  • Offloading HTTP authentication and authorization
  • Creating reCAPTCHA servers
• Application delivery
  • Rewriting & redirecting
  • Compression
  • Site Publishing (Single sign-on)
    • Offloaded authentication and optional SSO configuration
    • Adding servers to an authentication server pool
    • Configuring a Security Assertion Markup Language (SAML) server pool
    • Creating an Active Directory (AD) user for FortiWeb - Keytab File
    • Using Kerberos authentication delegation
    • Using Form Based Delegation
    • OAuth authorization & OIDC authentication
  • Caching
    • What can be cached?
  • Acceleration
  • Scripting
  • Waiting room
    • Customizing waiting room display page
• Web protection
  • Blocking known attacks
    • Connecting to FortiGuard services
    • Updating signatures from FortiGuard
    • Enforcing new FortiGuard signatures
    • Receiving quarantined source IP addresses from FortiGate
    • False Positive Mitigation for SQL Injection signatures
    • Configuring action overrides or exceptions to data leak & attack detection signatures
    • Defining custom data leak & attack signatures
    • Defeating cipher padding attacks on individually encrypted inputs
  • Advanced protection
    • Custom Policy
    • Defeating cross-site request forgery (CSRF) attacks
    • HTTP Header Security
    • Protection against Man-in-the-Browser (MiTB) attacks
      • Creating Man in the Browser (MiTB) Protection Rule
        • Creating an MiTB protection rule
        • Protecting the standard user input field
        • Protecting the passwords
        • Adding allow list for the AJAX Request
        • Detecting and mitigating SSL stripping
      • Creating Man in the Browser (MiTB) Protection Policy
    • URL encryption
    • Link cloaking
    • Syntax-based SQL/XSS injection detection
  • Data Loss Prevention
  • Cookie security
  • Input validation
    • Validating parameters (“input rules”)
    • Preventing tampering with hidden inputs
    • Limiting file uploads
    • Web Shell Detection
  • Protocol constraints
    • HTTP/HTTPS protocol constraints
    • WebSocket Protocol
    • gRPC protocol
  • Access control
    • Restricting access based on specific URLs
    • Specifying allowed HTTP methods
    • Cross-Origin Resource Sharing (CORS) protection
  • ML Based Anomaly Detection
    • Viewing domain data
      • Overview
      • Tree View
      • Parameter View
    • Viewing anomaly detection log
  • Anti-defacement
• Zero Trust Network Access (ZTNA)
  • Configuring FortiClient EMS Connector for ZTNA
  • Verifying EMS CA certificate, ZTNA tag, and FortiClient endpoint synchronized from FortiClient EMS
  • Configuring a ZTNA Profile
  • Referencing ZTNA profile in a server policy
  • ZTNA troubleshooting and debugging
• Bot mitigation
  • Configuring threshold based detection
  • Configuring biometrics based detection
  • Configuring bot deception
  • Configuring known bots
  • Configuring bot mitigation policy
  • Configuring ML Based Bot Detection policy
    • Viewing bot detection model status
    • Viewing the bot detection violations
  • Configuring Advanced Bot Protection policy
  • Exception Policy
• API Protection
  • Configuring JSON protection
    • Importing JSON schema files
    • Creating JSON protection rules
    • Creating JSON protection policy
  • Configuring XML protection
    • Importing XML schema files
    • Creating XML protection rules
    • Creating XML protection policies
    • Importing WSDL files
    • Importing XML DTD files
    • Configuring exempted URLs
    • Configuring attack logs to retain packet payloads for XML protection
    • Creating WS-Security rules
    • Creating XSW Detection rules
  • Configuring GraphQL protection
    • Creating GraphQL protection rules
    • Creating GraphQL protection policy
  • OpenAPI Validation
    • Use cases
    • Creating OpenAPI files
    • Creating OpenAPI validation policies
  • Configuring mobile API protection
  • API gateway
    • Managing API users
    • Configuring API gateway rules
    • Configuring API gateway policy
  • Configuring ML Based API Protection policy
    • Viewing API Protection domain data
    • Editing and viewing API paths schema
    • Viewing parameters with abnormal values
    • Scanning for sensitive data leakage in API endpoints
• DoS protection
  • DoS prevention
  • Preventing slow and low attacks
  • Exception Policy
• IP Protection
  • GEO IP - Blocklisting & whitelisting countries & regions
  • IP List - Blocklisting & whitelisting clients using a source IP or source IP range
  • IP Reputation - Blocklisting source IPs with poor reputation
  • Creating IP groups
• Tracking
  • Compliance
    • Authorization
    • Preventing data leaks
    • Vulnerability scans
• Administrators
  • Configuring access profiles
  • Grouping remote authentication queries and certificates for administrators
  • Changing an administrator’s password
  • Configuring SSL certificate for the administrator access to FortiWeb GUI via HTTPS
  • Certificate-based Web UI login
• Advanced/optional system settings
  • Changing the FortiWeb appliance’s host name
  • Fail-to-wire for power loss/reboots
  • Customizing error and authentication pages (replacement messages)
  • Configuring machine-learning URL replacer policy
  • Configuring the integrated firewall
    • Network address translation (NAT)
  • Advanced settings
  • Backup & restore
• Dashboard
  • Status dashboard
  • Monitors
    • FortiView Monitors
      • FortiView Topology
      • FortiView Countries
      • FortiView Threats
      • FortiView Server Policies
      • FortiView Threat Map
      • FortiView Bot Analysis
      • FortiView Scanner Integration
      • FortiView Log Analysis
      • FortiView Sources
      • FortiView Original Sources
    • Policy Status
    • Blocked IPs
    • Blocked Client IDs
    • OWASP Top 10 Compliance
• Log&Report
  • Logging
  • Alert email
  • SNMP traps & queries
  • Reports
  • Debug log
  • FortiGuard updates
  • Analyzing attack logs in FortiWeb Cloud Threat Analytics
• Security Fabric
  • Fabric Connectors
    • FortiGSLB
    • Single Sign On (SSO)
      • FortiGate SSO
      • Single Sign On with Azure
  • External connectors
    • AWS Connector
    • Azure Connector
    • OCI Connector
    • IP Address Connector
  • Automation
    • Creating a trigger
      • FortiWeb Log trigger
      • Schedule trigger
    • Creating an action
      • Email action
      • Microsoft Teams Notification action
      • Slack Notification action
      • Jira Notification action
      • Webhook action
      • IP Ban action
      • CLI Script action
      • Notification message examples
    • Creating a stitch
    • Use Cases
      • Use case: Real-time incident alerts
      • Use case: Expired SSL certificate management
      • Use case: Automated response to FortiGuard Database (FDS DB) updates
      • Use case: Automatic IP banning
      • Use case: Blocking repeated attacks from an IP address
      • Use case: Automating exception handling for false positives
• Ingress Controller
• Security Operations Center-as-a-Service (SOCaaS)
• Fine-tuning & best practices
  • Hardening security
  • Improving performance
  • Improving fault tolerance
  • Reducing false positives
  • Regular backups
  • Downloading logs in RAM before shutdown or reboot
• Troubleshooting
  • Introduction
  • Troubleshooting outline
  • Diagnosing server-policy connectivity issues
    • Diagnosing Network Connectivity Issues
      • Checking hardware connections
      • Examining the ARP table
      • Checking routing
      • Examining the routing table
      • Checking port assignments
      • Performing a packet trace
      • Debugging the packet processing flow
    • Diagnosing server-policy access issues
      • Server-policy access failure
      • Server policy intermittently inaccessible
      • Server-policy outage
      • Checking backend server status & issues
    • Diagnosing debug flow
    • Error codes displayed when visiting server policy
    • Visiting Server-Policy Has Long Response Time
    • Checking Attack/Traffic/Event logs
      • FAQ
      • How to check attack logs in FortiWeb
      • How to check traffic logs in FortiWeb
    • Forwarding non-HTTP/HTTPS traffic
  • Diagnosing system issues
    • System boot-up issues
      • Hard disk corruption or failure
      • Power supply failure
    • System login & authentication issues
      • FAQ
      • Login common issues
      • WebUI authentication issues
      • Certificate-based WebUI login failure
      • Resetting passwords
      • SAML SSO Login issues
    • System license issues
    • Firmware upgrade failures
    • DB version&update info
    • Cryptographic Key
    • Resetting the configuration
    • Restoring firmware (“clean install”)
    • Checking System Resource Issues
      • Checking CPU information&Issues
      • Checking memory usage
      • Diagnosing memory leak issues
      • Diagnosing kernel memory leak issues
      • Checking disk information & issues
    • Retrieving system&debug logs
      • Retrieving system logs in backend system
      • Customizing and downloading debug logs
    • Diagnose Crash & Coredump issues
      • Common troubleshooting steps
      • Checking core files and basic coredump information
      • Collecting core/coredump files and logs
      • What to do when coredump files are truncated or damaged
    • Diagnose memory violation issues
  • Diagnose software function issues
    • Server policy
      • FAQ
    • SSL/TLS
      • FAQ
      • Diagnosing SSL/TLS handshake failures
      • Decrypting SSL packets to analyze traffic issues
        • Enabling diagnose debug flow to retrieve TLS Pre-master secrets
        • Decrypting TLS 1.2/1.1/1.0 Traffic
        • Decrypting TLS 1.3 Traffic
        • An alternative way to decrypt TLS traffic on Windows PC
    • Application Delivery - URL Rewriting
    • Application Delivery - Site Publish
      • FAQ
      • Troubleshoot Site-Publish Issues
    • Application Delivery - Caching
      • FAQ
      • Troubleshoot for caching issues
    • Application Delivery - Lua Script
      • FAQ
    • Application Delivery - Waiting Room
    • Web Protection - General Issues
      • FAQ
    • Web Protection - Known Attack
      • FAQ
    • Web Protection - Advanced Protection
      • FAQ
    • Web Protection - Input Validation
      • FAQ
    • Web Protection - Bot Mitigation
      • FAQ
    • Web Protection - API Protection
      • FAQ
    • Web Protection - IP Protection
      • FAQ
    • Machine Learning - Anomaly Detection
      • FAQ
      • Machine learning trouble-shooting
    • ZTNA troubleshooting and debugging
    • HA issues
      • FAQ
      • HA trouble-shooting
    • Log&Report issues
      • Common troubleshooting methods for issues that Logs cannot be displayed on GUI
      • Step-by-step troubleshooting for log display on FortiWeb GUI failures
      • Logs cannot be displayed on FortiAnalyzer
    • Replacement message
      • FAQ
  • Diagnose hardware issues
    • Using diagnose commands
    • Diagnosing Power Supply issues
    • Diagnosing hard disk issues
    • Diagnosing SSL Card issues
    • Diagnosing NIC issues
  • System tools & diagnose commands
    • Diagnostic Commands
    • Execute Commands
    • Ping & Traceroute
    • Packet capture
      • Packet capture via CLI command
      • Packet capture via Web UI
    • Diff
    • Run backend-shell commands
    • Upload a file to or download a file from FortiWeb
• Appendix A: Port numbers
• Appendix B: Maximum configuration values
• Appendix C: FortiWeb-VM licenses
• Appendix D: Supported RFCs, W3C, & IEEE standards
• Appendix E: Regular expressions
• Appendix F: How to purchase and renew FortiGuard licenses
• Appendix G: Supported image versions for EOS models