FortiWeb Lesson 04: Virtual Servers, Server Pools and Your First Server Policy

FORTIWEB CLASSROOM • LESSON 04

Level: Beginner · Study and lab: 75 minutes
Instructor: Harpreet Singh Virdi, CISSP, CCSP

FortiWeb course guide · FortiWeb training block

---

Build the traffic path

Our isolated reverse-proxy lab is ready. Today you will configure the objects that connect a browser to the test application. Keep security changes simple until the basic path works.

Understand the object relationships

Virtual server + service
          ↓
     Server policy → server pool → origin
          ↓
  Web protection profile → security rules

A virtual server supplies the listening address. A service identifies the protocol/port configuration. A server pool identifies the origin services. The server policy references these objects and the applicable protection profile. Host restrictions help identify which website names the policy should accept.

A pool is not necessarily a collection of identical physical machines: its supported members and behavior depend on the configuration. For our first exercise, use one simple test origin to reduce variables.

Guided lab

1. Record the application hostname, virtual address, origin address/port, and expected homepage response.
2. Under Server Objects → Server → Virtual Server, create the lab virtual server. Menu wording may vary by firmware.
3. Under Server Objects → Server → Server Pool, define the test origin and an appropriate health check.
4. Create a lab-specific web protection profile. Review its selected rules and actions rather than assuming its name describes all settings.
5. Under Policy → Server Policy, create a clearly named reverse-proxy policy referencing the listener, service, pool, and profile.
6. Configure the intended hostname restrictions and routing. For initial HTTP tests, keep the lab isolated; HTTPS is covered next.
7. Resolve books.example.test to the virtual address and request the homepage through it.
8. Record the response and the policy used. Verify the origin was reached through FortiWeb.

Expected result: a valid request succeeds through the selected server policy. You can trace each reference in the object chain. An available pool alone does not prove the protection profile is being used.

Understand health checks

A monitor should check a meaningful application endpoint. A server can answer TCP while its application is failing. Conversely, an HTTP health check can fail because it uses the wrong path, Host header, or expected response. Compare the monitor's request with the application's requirements.

When the page fails

Separate listener matching, origin reachability, health status, return routing, and security actions. Inspect the actual selected policy before editing a profile. A rule that was created but never referenced cannot protect this traffic.

Knowledge check

You created a signature policy. Is that enough to protect the bookshop?

Instructor answer

No. Verify that the intended protection profile references it and that the server policy handling the request uses that profile. Test observable behavior and events as well.

---

Official reading

• Fortinet: configuring basic policies
• Fortinet: 399384
• Fortinet: server policy policy

Independent training, not affiliated with Fortinet. Examples use an authorized isolated lab with synthetic data. The lab steps and expected outcomes have not been executed on a FortiWeb appliance for this publication. Firmware, platform, operating mode, licensing, and subscriptions affect behavior; follow the documentation for your exact build. References use 8.0.x examples and do not constitute an upgrade recommendation.

← Previous FortiWeb lesson · FortiWeb course guide · Next FortiWeb lesson →