Administration Guide

• Introduction
• What's new
• Key concepts
  • Workflow
  • Sequence of scans
  • IPv6 support
  • Solutions for specific web attacks
  • HTTP/2 support
  • HTTP sessions & security
  • FortiWeb high availability (HA)
  • Administrative domains (ADOMs)
  • How to use the web UI
  • Shutdown
• How to set up your FortiWeb
  • Appliance vs. VMware
  • Registering your FortiWeb
  • Planning the network topology
  • Connecting to the web UI or CLI
  • Updating the firmware
  • Changing the “admin” account password
  • Setting the system time & date
  • Setting the operation mode
  • Feature visibility
  • Configuring High Availability (HA) basic settings
    • HA heartbeat & active node election
    • Synchronization
  • Replicating the configuration without FortiWeb HA (external HA)
  • Configuring the network settings
  • Configuring DNS settings
  • Configuring HA settings specifically for active-passive and standard active-active modes
  • Configuring HA settings specifically for high volume active-active mode
  • Defining your web servers & load balancers
    • Protected web servers vs. allowed/protected host names
    • Defining your protected/allowed HTTP “Host:” header names
    • Defining your web servers
    • Defining your proxies, clients, & X-headers
    • Defining your network services
    • Configuring virtual servers on your FortiWeb
    • Enabling or disabling traffic forwarding to your servers
  • Configuring FortiWeb to receive traffic via WCCP
  • Configuring basic policies
  • Testing your installation
  • Switching out of Offline Protection mode
• Policies
  • How operation mode affects server policy behavior
  • Configuring the global object allow list
  • Configuring the allow list at server policy level
  • Configuring a protection profile for inline topologies
  • Generating a protection profile using scanner reports
  • Configuring a protection profile for an out-of-band topology or asynchronous mode of operation
  • Configuring client management
  • Configuring an HTTP server policy
  • Configuring traffic mirror
  • ADFS Proxy
    • Configuring FortiWeb as an ADFS proxy
    • Configuring a virtual server
    • Creating an ADFS server pool
    • Uploading trusted CA certificates
    • Creating an ADFS server policy
    • Troubleshooting
  • Configuring FTP security
    • Creating an FTP command restriction rule
    • Creating an FTP file check rule
    • Configuring an FTP security inline profile
    • Creating an FTP server pool
    • Creating an FTP server policy
• Secure connections (SSL/TLS)
  • Offloading vs. inspection
  • Supported cipher suites & protocol versions
    • Supported cipher suites - for connections between FortiWeb and the clients
    • Supported cipher suites - for connection between FortiWeb and back-end servers
  • CA certificates
  • How to offload or inspect HTTPS
    • Local certificates
    • Let's Encrypt certificates
    • Using session keys provided by an HSM
    • Generating a certificate signing request
    • Uploading a server certificate
  • Forcing clients to use HTTPS
  • HTTP Public Key Pinning
  • How to apply PKI client authentication (personal certificates)
  • Seamless PKI integration
  • Revoking certificates
  • How to export/back up certificates & private keys
  • How to change FortiWeb's default certificate
  • Configuring OCSP stapling
• Users
  • Authentication styles
  • Offloading HTTP authentication & authorization
  • Creating reCAPTCHA servers
  • OAuth Authorization
• Application delivery
  • Rewriting & redirecting
  • Compression
  • Site Publishing (Single sign-on)
    • Offloaded authentication and optional SSO configuration
    • Creating an Active Directory (AD) user for FortiWeb - Keytab File
    • Using Kerberos authentication delegation
    • Using Form Based Delegation
  • Caching
    • What can be cached?
  • Acceleration
  • Scripting
• Web protection
  • Blocking known attacks
    • Connecting to FortiGuard services
    • Receiving quarantined source IP addresses from FortiGate
    • False Positive Mitigation for SQL Injection signatures
    • Configuring action overrides or exceptions to data leak & attack detection signatures
    • Defining custom data leak & attack signatures
    • Defeating cipher padding attacks on individually encrypted inputs
  • Advanced protection
    • Custom Policy
    • Defeating cross-site request forgery (CSRF) attacks
    • HTTP Security Headers
    • Protection for Man-in-the-Browser (MiTB) attacks
      • Creating Man in the Browser (MiTB) Protection Rule
        • Creating an MiTB protection rule
        • Protecting the standard user input field
        • Protecting the passwords
        • Adding allow list for the AJAX Request
      • Creating Man in the Browser (MiTB) Protection Policy
    • URL encryption
    • Link cloaking
    • Syntax-based SQL/XSS injection detection
  • Cookie security
  • Input validation
    • Validating parameters (“input rules”)
    • Preventing tampering with hidden inputs
    • Limiting file uploads
    • Web Shell Detection
  • Protocol constraints
    • HTTP/HTTPS protocol constraints
    • WebSocket Protocol
  • Access control
    • Restricting access based on specific URLs
    • Cross-Origin Resource Sharing (CORS) protection
    • Specifying allowed HTTP methods
  • ML Based Anomaly Detection
    • Viewing domain data
      • Overview
      • Tree View
      • Parameter View
    • Viewing anomaly detection log
  • Anti-defacement
• Zero Trust Network Access (ZTNA)
  • Configuring FortiClient EMS Connector for ZTNA
  • Verifying EMS CA certificate, ZTNA tag, and FortiClient endpoint synchronized from FortiClient EMS
  • Configuring a ZTNA Profile
  • Referencing ZTNA profile in a server policy
  • ZTNA troubleshooting and debugging
• Bot mitigation
  • Configuring threshold based detection
  • Configuring biometrics based detection
  • Configuring bot deception
  • Configuring known bots
  • Configuring bot mitigation policy
  • Configuring ML Based Bot Detection policy
    • Viewing bot detection model status
    • Viewing the bot detection violations
  • Exception Policy
• API Protection
  • Configuring JSON protection
    • Importing JSON schema files
    • Creating JSON protection rules
    • Creating JSON protection policy
  • Configuring XML protection
    • Importing XML schema files
    • Creating XML protection rules
    • Creating XML protection policies
    • Importing WSDL files
    • Configuring exempted URLs
    • Configuring attack logs to retain packet payloads for XML protection
    • Creating WS-Security rules
  • OpenAPI Validation
    • Use cases
    • Creating OpenAPI files
    • Creating OpenAPI validation policies
  • Configuring mobile API protection
  • API gateway
    • Managing API users
    • Configuring API gateway policy
    • Configuring API gateway rules
  • Configuring ML Based API Protection policy
    • Viewing API Protection domain data
    • Editing and viewing machine learning models for API paths
• DoS protection
  • DoS prevention
  • Preventing slow and low attacks
• IP Protection
  • GEO IP - Blocklisting & whitelisting countries & regions
  • IP List - Blocklisting & whitelisting clients using a source IP or source IP range
  • IP Reputation - Blocklisting source IPs with poor reputation
  • Creating IP groups
• Tracking
• Compliance
  • Authorization
  • Preventing data leaks
  • Vulnerability scans
• Administrators
  • Configuring access profiles
  • Grouping remote authentication queries and certificates for administrators
  • Changing an administrator’s password
  • Certificate-based Web UI login
• Advanced/optional system settings
  • Changing the FortiWeb appliance’s host name
  • Fail-to-wire for power loss/reboots
  • Customizing error and authentication pages (replacement messages)
  • Configuring machine-learning URL replacer policy
  • Configuring the integrated firewall
    • Network address translation (NAT)
  • Advanced settings
  • Backup & restore
• Dashboard
  • Status dashboard
  • Monitors
    • FortiView Monitors
      • FortiView Topology
      • FortiView Countries
      • FortiView Threats
      • FortiView Server Policies
      • FortiView Threat Map
      • FortiView Bot Analysis
      • FortiView Scanner Integration
      • FortiView Sources
    • Policy Status
    • Blocked IPs
    • Blocked Client IDs
• Log&Report
  • Logging
  • Alert email
  • SNMP traps & queries
  • Reports
  • Debug log
  • FortiGuard updates
  • Analyzing attack logs in FortiWeb Cloud Threat Analytics
• Security Fabric
  • External connectors
    • AWS Connector
    • Azure Connector
    • OCI Connector
  • Fabric Connector: Single Sign On with FortiGate
• Fine-tuning & best practices
  • Hardening security
  • Improving performance
  • Improving fault tolerance
  • Reducing false positives
  • Regular backups
  • Downloading logs in RAM before shutdown or reboot
• Troubleshooting
  • Introduction
  • Troubleshooting outline
  • Diagnosing server-policy connectivity issues
    • Diagnosing Network Connectivity Issues
      • Checking hardware connections
      • Examining the ARP table
      • Checking routing
      • Examining the routing table
      • Checking port assignments
      • Performing a packet trace
      • Debugging the packet processing flow
    • Diagnosing server-policy access issues
      • Server-policy access failure
      • Server policy intermittently inaccessible
      • Server-policy outage
      • Checking backend server status & issues
    • Diagnosing debug flow
    • Error codes displayed when visiting server policy
    • Visiting Server-Policy Has Long Response Time
    • Checking Attack/Traffic/Event logs
      • FAQ
      • How to check attack logs in FortiWeb
      • How to check traffic logs in FortiWeb
    • Forwarding non-HTTP/HTTPS traffic
  • Diagnosing system issues
    • System boot-up issues
      • Hard disk corruption or failure
      • Power supply failure
    • System login & authentication issues
      • FAQ
      • Login common issues
      • WebUI authentication issues
      • Certificate-based WebUI login failure
      • Resetting passwords
      • SAML SSO Login issues
    • System license issues
    • Firmware upgrade failures
    • DB version&update info
    • Cryptographic Key
    • Resetting the configuration
    • Restoring firmware (“clean install”)
    • Checking System Resource Issues
      • Checking CPU information&Issues
      • Checking memory usage
      • Diagnosing memory leak issues
      • Diagnosing kernel memory leak issues
      • Checking disk information & issues
    • Retrieving system&debug logs
      • Retrieving system logs in backend system
      • Customizing and downloading debug logs
    • Diagnose Crash & Coredump issues
      • Common troubleshooting steps
      • Checking core files and basic coredump information
      • Collecting core/coredump files and logs
      • What to do when coredump files are truncated or damaged
    • Diagnose memory violation issues
  • Diagnose software function issues
    • Server policy
      • FAQ
    • SSL/TLS
      • FAQ
      • Diagnosing SSL/TLS handshake failures
      • Decrypting SSL packets to analyze traffic issues
        • Enabling diagnose debug flow to retrieve TLS Pre-master secrets
        • Decrypting TLS 1.2/1.1/1.0 Traffic
        • Decrypting TLS 1.3 Traffic
        • An alternative way to decrypt TLS traffic on Windows PC
    • Application Delivery - URL Rewriting
    • Application Delivery - Site Publish
      • FAQ
      • Troubleshoot Site-Publish Issues
    • Application Delivery - Caching
      • FAQ
      • Troubleshoot for caching issues
    • Application Delivery - Lua Script
      • FAQ
    • Web Protection - General Issues
      • FAQ
    • Web Protection - Known Attack
      • FAQ
    • Web Protection - Advanced Protection
      • FAQ
    • Web Protection - Input Validation
      • FAQ
    • Web Protection - Bot Mitigation
      • FAQ
    • Web Protection - API Protection
      • FAQ
    • Web Protection - IP Protection
      • FAQ
    • Machine Learning - Anomaly Detection
      • FAQ
      • Machine learning trouble-shooting
    • ZTNA troubleshooting and debugging
    • HA issues
      • FAQ
      • HA trouble-shooting
    • Log&Report issues
      • Common troubleshooting methods for issues that Logs cannot be displayed on GUI
      • Step-by-step troubleshooting for log display on FortiWeb GUI failures
      • Logs cannot be displayed on FortiAnalyzer
    • Replacement message
      • FAQ
  • Diagnose hardware issues
    • Using diagnose commands
    • Diagnosing Power Supply issues
    • Diagnosing hard disk issues
    • Diagnosing SSL Card issues
    • Diagnosing NIC issues
  • System tools & diagnose commands
    • Diagnostic Commands
    • Execute Commands
    • Ping & Traceroute
    • Packet capture
      • Packet capture via CLI command
      • Packet capture via Web UI
    • Diff
    • Run backend-shell commands
    • Upload a file to or download a file from FortiWeb
• Appendix A: Port numbers
• Appendix B: Maximum configuration values
• Appendix C: FortiWeb-VM licenses
• Appendix D: Supported RFCs, W3C, & IEEE standards
• Appendix E: Regular expressions
• Appendix F: How to purchase and renew FortiGuard licenses