FortiGate Web Application Firewall (WAF) configuration and troubleshooting

[JimBo]

Hi guys,

Hoping to find Fortigate WAF configuration and troubleshooting help.

I see the Fortigate docs provide bits and peices of this WAF technology for FortiGate firewall (mostly just scratch the surface), Youtube videos provide a little bit more info and I can sort of set it up and assign WAF policy to an active security policy but what's next? Is there a way to verify configuration, traffic flows, detection of hacks, logging, which WAF features should be enabled and for what reason, how to troubleshoot and etc.

We are currently use FortiOS 7.0.12 and don't have the FortiWeb appliance.

Thanks for any assistance

Jimmy

[Rajan_kohli · Accepted solution]

Hi @JimBo 

You can use this link for configuration of WAF: https://docs.fortinet.com/document/fortigate/7.4.1/administration-guide/491256/protecting-a-server-r...

For troubleshooting logs issue: https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-How-to-investigate-if-WAF-is-not-gen...

Regards

Rajan

[AEK]

Hello

• The way to verify the configuration: Try access your Web server through through FGT
• Check traffic flows: Enable logging in your policy, and check logs in Log & Report > Forward Traffic
• Detection of hacks: Go to Log & Report > Web Application Firewall
• WAF features to enable: Use default profile, then tune if needed, e.g.: disable some signatures if you have false positives

[Rajan_kohli · Accepted solution]

Hi @JimBo 

You can use this link for configuration of WAF: https://docs.fortinet.com/document/fortigate/7.4.1/administration-guide/491256/protecting-a-server-r...

For troubleshooting logs issue: https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-How-to-investigate-if-WAF-is-not-gen...

Regards

Rajan

[JimBo]

Hi guys, 

I have my border fw setup and passing traffic. I see traffic reaching my border firewall and being passed to my server (another FortiGate used to simulate a web server). Log & Report, Forward Traffic shows Allowed and Blocked traffic as expected. Once our web server is installed, I'll add it in-line for public access but for now just trying to understand the ins and outs of this WAF technology before I expose it to the world.

The 1st url link shows how to test the WAF with invalid traffic - When I run the example script http://<IP>/index.php?username=1'%20or%20'1'%20=%20'1&password=1'%20or%20'1'%20= %20'1,  I receive SQL Injection error messages under Log & Report, Intrusion Prevention but not under the Web Application Firewall. I guess an error message is good no matter where it shows up. I can run this command multiple times to produce the error message.

The second url link show how to enable logging under the WAF configuration and nothing shows up yet ... I'll keep an eye on this one.

I'm new to the WAF and I guess there would be some technical discussions surrounding this technology.

Thanks for sharing, and if you have more, PLEASE pass it along!!!!!

[pminarik]

That means the "attack" was detected and blocked by IPS inspection, not by WAF.

If you have both IPS and WAF enabled in a policy, that's expected, since IPS (via IPS engine) is applied first, WAF (and other proxy-mode inspection profiles) only afterwards.

ref: https://docs.fortinet.com/document/fortigate/6.4.0/parallel-path-processing-life-of-a-packet/200486/...

If your goal is to specifically test and observe WAF's behaviour, remove the IPS profile from the firewall policy and keep only WAF in it (+the relevant SSL inspection profile, of course).

[JimBo]

I removed all of the Security Profiles from the Security Policy - (AntiVirus, Web Filter, Video filter, DNS filter, Application Control, IPS, File filter) and only have Web Application Firewall (default) and SSL inspection (not removable) enabled. I can reach the web server across the Internet just fine. Log & Report, Forward Traffic shows this traffic as successful as expected.

When I run the example hack URL (http and/or https)

https://<ip>/index.php?username=1'%20or%20'1'%20=%20'1&password=1'%20or%20'1'%20=%20'1

Log & Report, Forward Traffic sometimes shows this traffic as "TCP reset from client" and other times it seems to allow the traffic through, but no traffic shows up in the Log & Report, Web Application Firewall section which is strange because I also enabled logging in the cli WAF profile as described in this url.

For troubleshooting logs issue:

https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-How-to-investigate-if-WAF-is-not-gen...

Any additional thoughts?

Thank you

[pminarik · Accepted solution]

The WAF signatures aren't really maintained anymore, so it's hard to say how well the individual default signatures are expected to work.

The WAF profile should certainly work for method (GET/POST/...) and path (/some/where/to/access) restrictions, but beyond that you need to be careful.

Combining with IPS may help (as seen with IPS blocking the injection previously;)), but the typical recommendation as far as I can see is to use a dedicated WAF appliance, e.g. FortiWeb.

[JimBo]

Thank you guys for all your assistance.

I finally figured out how to get the WAF logging operational and most of my valid traffic to the internal server was flagged as invalid with an orange severity level but allowed to pass or flagged as SQL Injection and blocked. Apparently, my newer browsers (Chrome and Safari) ask or offer more than the older WAF signatures understand (I'm guessing). The trick to get logging working within the WAF logging section was to map the external/internal destination ports correctly. Duh.

I did confirm with FortiNet support that the WAF signatures are indeed no longer supported on the FortiGate setup to support the WAF feature. The FortiGate WAF does operate at some level and could be used as a test lab to gain familiarity but probably not for real protection.

Thanks again.