FortiWeb Lesson 17: Capstone — Build, Tune, Troubleshoot and Recover
FORTIWEB CLASSROOM • LESSON 17
Level: Advanced practical assessment · Study and lab: 120 minutes
Instructor: Harpreet Singh Virdi, CISSP, CCSP
FortiWeb course guide · FortiWeb training block
Your final classroom assignment
Protect the fictional bookshop using an isolated FortiWeb reverse-proxy lab. Demonstrate that you understand both the traffic path and the security decisions. The assessment measures evidence and reasoning; reading the series alone does not establish operational mastery.
Prepare your evidence pack
Include the topology, firmware/build, licensed capabilities, server policies, protection-profile references, application input contract, sanitized events, regression table, exceptions, and recovery procedure. Use synthetic accounts and test data.
Task 1: prove traffic selection
Show the virtual server, service, origin pool, and selected server policy. Explain client-side and origin-side TLS. Demonstrate that test traffic goes through FortiWeb rather than directly to the origin.
Task 2: describe the application
Document at least five endpoints with their methods, parameters, and valid boundaries. Explain one URL access rule, one protocol constraint, and one API contract. Identify which requirements remain application responsibilities.
Task 3: demonstrate detection and response
Use a deterministic lab rule to show an observation action and a supported enforcement action. Identify the exact event and response. Explain how another scan could affect the same request.
Task 4: learn and tune
Present a representative traffic plan and discuss any ML model gaps. Reproduce one legitimate edge case that conflicts with an intentionally restrictive lab rule. Apply a scoped correction, then show the valid case succeeds and relevant negative controls remain effective.
Task 5: troubleshoot an ambiguous failure
Have a partner generate an application-originated failure or a request using another policy path. Investigate without assuming FortiWeb caused it. Correlate time, policy, action, matched location, and backend evidence.
Task 6: recover
Restore the tested configuration in a recovery environment, verify dependencies, and rerun core tests. If you have a supported HA lab, add a controlled failover and test protection on the new traffic owner.
Classroom scoring
| Area | Points |
|---|---|
| Traffic path and TLS explanation | 15 |
| Application-specific policy model | 20 |
| Detection, action, and learning reasoning | 20 |
| Scoped tuning with regression evidence | 20 |
| Evidence-based troubleshooting | 15 |
| Tested recovery | 10 |
Suggested target: 80/100, with no unexplained broad bypass or untested recovery procedure. This is a learning rubric, not a Fortinet certification or endorsement.
Instructor debrief
Explain one tradeoff, one remaining coverage gap, and what you would monitor after deployment. Repeat the assessment after an application release or firmware change. Continue with release-specific deep dives into GraphQL/gRPC, custom rules, advanced bot detection, client-side protection, and supported integrations.
Final knowledge check
What does a strong engineer do when the evidence is incomplete?
Instructor answer
State the uncertainty, preserve useful evidence, and choose a bounded next test. Avoid claiming protection or compromise beyond what the observations support.
Official reading
Independent training, not affiliated with Fortinet. Examples use an authorized isolated lab with synthetic data. The lab steps and expected outcomes have not been executed on a FortiWeb appliance for this publication. Firmware, platform, operating mode, licensing, and subscriptions affect behavior; follow the documentation for your exact build. References use 8.0.x examples and do not constitute an upgrade recommendation.
Comments
Post a Comment