Key considerations of network settings in Offline Protection mode

1. SPAN Port

Use a cable to connect firewall's SPAN port to FortiWeb’s data capture interface.

• Firewall Interfaces
  Since FortiWeb operates passively, it relies on a firewall SPAN (Switched Port Analyzer) session to receive a copy of web traffic. The firewall should set the following interfaces:

  • WAN: Connected to clients

  • LAN: Connected to web servers.

  • SPAN Port: Mirrors traffic from WAN to FortiWeb’s data capture port.

• FortiWeb Interfaces:

  In the Data Capture Port option of the FortiWeb's Server Policy settings, select the network interface connecting to Firewall's SPAN port.

2. Blocking Port

FortiWeb requires a separate physical network interface (e.g., port4) designated as the blocking port. This interface is used exclusively to inject RST packets into the network.

Network requirements:

• The blocking port must be connected to a network segment with reachability to both clients and servers.

  Example: If clients are on the Internet and servers are in a DMZ, the blocking port should be in a subnet that can route traffic to both.

• The blocking port typically requires an IP address (or operates in Layer 2 mode) to communicate with the network.

• FortiWeb must have valid ARP entries for clients/servers to spoof source IPs correctly.

Firewall/Router Rules:

• Ensure firewalls or routers between FortiWeb’s blocking port and the client/server networks:

  • Allow TCP RST packets from FortiWeb’s blocking port.

  • Do not block spoofed source IPs (FortiWeb mimics client/server IPs in RST packets).

  • The TCP RST packets generated by the blocking port can be correctly routed to its destination.

FortiWeb configurations:

• In Network > Interfaces, assign a dedicated network interface as the blocking port.

• In Policy > Server Policy, select the Blocking Port.