Training and CyberInsights Today

F5 ASM

17 lessons · Beginner to advanced

Policies, staging, learning, signatures, tuning, API security, logs and recovery.

F5 ASM training →

FortiWeb

17 lessons · Beginner to advanced

Server policies, profiles, ML, signatures, APIs, troubleshooting and HA.

FortiWeb training →

How to use the WAF training hub

CyberInsights Today

Daily cybersecurity analysis and practical bulletins

Understand recent vulnerabilities, threats, their impact and mitigation. When there is no worthwhile new issue, learn a security concept or defensive practice through clear explanations, illustrations and evidence.

Read CyberInsights Today →

FortiWeb Lesson 03: Deployment Modes and an Isolated Reverse-Proxy Lab

FORTIWEB CLASSROOM • LESSON 03

Level: Beginner · Study and lab: 75 minutes
Instructor: Harpreet Singh Virdi, CISSP, CCSP

FortiWeb course guide · FortiWeb training block

Choose a topology deliberately

Operating mode affects how FortiWeb receives, inspects, and forwards traffic, and which protections it supports. Do not confuse a network deployment mode with a rule action such as Alert. A transparent topology is not a synonym for observation-only security.

The modes at a glance

Reverse Proxy: clients connect to a virtual server, and FortiWeb forwards accepted traffic toward a server pool. True Transparent Proxy: an inline bridge/proxy deployment with its own forwarding and feature behavior. Transparent Inspection: an inspection topology with different enforcement characteristics. Offline Protection: an out-of-band approach with significant visibility and prevention limits. WCCP is another supported integration topology in applicable releases.

These modes are not interchangeable. Consult the supported-feature matrix and traffic requirements for your build. Out-of-band reset attempts are not equivalent to deterministic inline request blocking. Changing mode can invalidate or remove incompatible configuration; do not experiment with it on a live system.

Our lab plan

Lab client → FortiWeb virtual address → isolated test server
Management workstation → restricted management interface

Use a supported FortiWeb appliance or properly licensed VM, a test client, and a simple bookshop application. Keep credentials and customer data synthetic. Choose sizing, firmware, and VM platform requirements from the deployment documentation. A downloaded image without the needed license and resources is not a completed lab.

Guided lab

  1. Record the firmware build, platform, license capabilities, and required subscriptions.
  2. Draw management and application networks separately.
  3. Place the application server on an isolated network; avoid public exposure.
  4. Configure the reverse-proxy design using the supported setup procedure.
  5. Record routing, interface addresses, DNS resolution, and which traffic is permitted.
  6. Establish time synchronization and basic monitoring for meaningful event correlation.
  7. Verify management access is limited to the intended lab administration path.
  8. Record a baseline application request directly within the isolated lab before introducing the proxy path.

Expected result: a topology and prerequisites worksheet. You know the chosen mode and can explain the return path. The next lesson builds the traffic objects and server policy.

Troubleshooting before security rules

A timeout can be a routing, listener, or filtering problem. A TLS failure can be a name, trust, or protocol issue. A healthy management interface proves neither an available origin nor a correctly configured application listener. Work layer by layer.

Knowledge check

Should you select Transparent Inspection simply because you want to observe violations without disrupting users?

Instructor answer

No. Choose topology based on deployment requirements and supported behavior. Then separately configure the intended detection and response actions for that topology.

Official reading

Independent training, not affiliated with Fortinet. Examples use an authorized isolated lab with synthetic data. The lab steps and expected outcomes have not been executed on a FortiWeb appliance for this publication. Firmware, platform, operating mode, licensing, and subscriptions affect behavior; follow the documentation for your exact build. References use 8.0.x examples and do not constitute an upgrade recommendation.

← Previous FortiWeb lesson · FortiWeb course guide · Next FortiWeb lesson →

Comments

Post a Comment

Popular posts from this blog

PHP2Shell Explained: Impact, Patches and Mitigation for CVE-2026-109618 and CVE-2026-109619

By Harpreet Singh Virdi, CISSP, CCSP · Cybersecurity Updates Published and evidence checked: November 3, 2026. If you run PHP, start with an inventory and a patch decision today. If a security appliance uses PHP internally, check its vendor advisory too. Updating your website code alone does not update the runtime inside a firewall. PHP2Shell is the name used for CVE-2026-109618 and CVE-2026-109619. They can allow remote code execution without authentication. PHP released security updates on October 21. The PHP team identifies web-serving installations as at risk and highlights Apache mod_php as the highest-risk configuration. PHP security announcements .
Read more

Start Here: F5 ASM Classroom — From Beginner to Advanced

WELCOME TO YOUR ONLINE CLASSROOM Learn F5 ASM, one clear lesson at a time. A practical English-language course for beginners, progressing to advanced policy operations. Instructor: Harpreet Singh Virdi, CISSP, CCSP Start here — you do not need prior ASM experience If the words “security policy,” “staging,” and “learning suggestion” feel unfamiliar, you are in the right place. We will explain them carefully, follow a web request through BIG-IP, and build a policy around a fictional online bookshop. F5 ASM means BIG-IP Application Security Manager. It inspects application traffic against configured security checks. The course explains how to use those checks, investigate their results, and protect legitimate user journeys. Advanced WAF terminology also appears; feature availability depends on your release and license. How to take this course Read the lessons in numerical order. Each is a separate blog post. Learn the terms, then work through the example before changing settings. Use an ...
Read more

Lesson 01: What Is F5 ASM? Your First Web Application Firewall Class

F5 ASM CLASSROOM • LESSON 01 Level: Beginner  |  Suggested study and lab time: 30 minutes Instructor: Harpreet Singh Virdi, CISSP, CCSP Start Here / Course Guide · All lessons Welcome to class Imagine running an online bookshop. Your website must accept searches, logins, and orders from people you have never met. The same public entrance also receives malformed requests and attempts to exploit software weaknesses. How do you distinguish a normal search from a suspicious request? A web application firewall (WAF) examines web traffic using rules about the application and patterns associated with attacks. F5 BIG-IP Application Security Manager, usually called ASM , is a WAF capability on the BIG-IP platform. Our task is to understand the traffic, define appropriate checks, investigate the results, and enforce protection without unnecessarily disrupting legitimate users. What you will learn Explain the purpose of a WAF in your own words. Identify where ASM fits in a web reque...
Read more