FortiWeb Lesson 01: What Is FortiWeb? Your First WAF Class
FORTIWEB CLASSROOM • LESSON 01
Level: Beginner · Study and lab: 30 minutes
Instructor: Harpreet Singh Virdi, CISSP, CCSP
FortiWeb course guide · FortiWeb training block
Welcome to the FortiWeb classroom
Imagine an online bookshop that accepts searches, logins, and orders. The public website must accept input from strangers. Some input is ordinary; some is malformed or intended to exploit a weakness. A web application firewall, or WAF, examines web traffic using configured security checks.
FortiWeb is Fortinet's WAF product. In this course we focus on FortiWeb appliance/VM administration, using a reverse-proxy lab. Other Fortinet products and cloud services can have different interfaces and workflows. Check the product name and release before following instructions.
Learning objectives
- Explain what a WAF contributes to application security.
- Identify FortiWeb's place in the request path.
- Understand the difference between an alert and demonstrated exploitation.
Follow one request
Browser → FortiWeb listener → application server Browser ← response or configured security response ← FortiWeb
Our browser asks for /search?q=networking. FortiWeb receives the connection through its traffic configuration, selects the applicable server policy, and evaluates the associated protections. An accepted request can reach the application. What happens to a detected violation depends on the configured action and operating mode.
A server policy connects traffic selection and forwarding with security configuration. A web protection profile brings security settings together. Individual rules or policies define particular checks. Creating a rule alone does not prove that live traffic uses it.
Three important distinctions
Detection: a configured check recognized something. Prevention: a control stopped or changed the relevant traffic. Exploitation: an attacker actually caused an unintended result. These are related, but different, events.
A false positive is legitimate activity incorrectly classified as suspicious. A false negative is harmful activity that escapes the necessary detection or prevention. Our job is to investigate both, not simply eliminate alerts.
What FortiWeb does not replace
The application still needs secure coding, parameterized database queries, safe output rendering, authentication, and authorization. Infrastructure still needs patching, restricted administration, and monitoring. A structurally valid request can access another person's order if the application fails to check ownership.
Classroom exercise
- Draw a client, FortiWeb, and a bookshop server.
- Mark the inspection point and both traffic directions.
- Add a direct route to the origin. Explain why traffic on that route could bypass FortiWeb.
- Write one application risk that requires a fix in the application itself.
Expected result: you can explain the security boundary and one limitation without using product jargon.
Knowledge check
Does an attack-signature alert prove the server was compromised?
Instructor answer
No. It records a detection. Investigate the action, matched content, application behavior, and supporting evidence to determine whether exploitation occurred.
Before moving on: explain the difference between a WAF and the application it protects. Next we will read HTTP messages.
Official reading
Independent training, not affiliated with Fortinet. Examples use an authorized isolated lab with synthetic data. The lab steps and expected outcomes have not been executed on a FortiWeb appliance for this publication. Firmware, platform, operating mode, licensing, and subscriptions affect behavior; follow the documentation for your exact build. References use 8.0.x examples and do not constitute an upgrade recommendation.
Comments
Post a Comment