Training and CyberInsights Today

F5 ASM

17 lessons · Beginner to advanced

Policies, staging, learning, signatures, tuning, API security, logs and recovery.

F5 ASM training →

FortiWeb

17 lessons · Beginner to advanced

Server policies, profiles, ML, signatures, APIs, troubleshooting and HA.

FortiWeb training →

How to use the WAF training hub

CyberInsights Today

Daily cybersecurity analysis and practical bulletins

Understand recent vulnerabilities, threats, their impact and mitigation. When there is no worthwhile new issue, learn a security concept or defensive practice through clear explanations, illustrations and evidence.

Read CyberInsights Today →

FortiWeb Training: Beginner to Advanced Course Guide

FORTIWEB TRAINING BLOCK

Learn FortiWeb from the ground up

17 instructor-led lessons in English, from WAF fundamentals to advanced operations.

With Harpreet Singh Virdi, CISSP, CCSP

Start here: no prior FortiWeb experience required

We follow a fictional bookshop through a reverse-proxy lab. Each lesson is a separate post with explanations, a practical exercise, expected results, and an instructor knowledge check. Learn FortiWeb's own server-policy, protection-profile, and rule relationships.

This course covers FortiWeb appliance/VM administration. Firmware, licenses, platforms, and operating modes affect features. References use 8.0.x examples; follow documentation for your actual build. This is not a recommendation to deploy a specific release.

How to study

  1. Read in numerical order and keep a lab notebook.
  2. Use a licensed, isolated, authorized lab with synthetic data.
  3. Record the configuration and actual result for each test.
  4. Compare observations with expected outcomes and investigate differences.
  5. Answer the knowledge check before opening the instructor answer.

Foundations

  1. FortiWeb Lesson 01: What Is FortiWeb? Your First WAF Class
    30 minutes · Beginner
  2. FortiWeb Lesson 02: Read HTTP, HTTPS, Headers, Cookies and JSON
    45 minutes · Beginner
  3. FortiWeb Lesson 03: Deployment Modes and an Isolated Reverse-Proxy Lab
    75 minutes · Beginner
  4. FortiWeb Lesson 04: Virtual Servers, Server Pools and Your First Server Policy
    75 minutes · Beginner
  5. FortiWeb Lesson 05: HTTPS Certificates, TLS and Trusted Client IPs
    60 minutes · Beginner to intermediate

Build, investigate and tune

  1. FortiWeb Lesson 06: Protection Profiles, Rule Actions and Scan Order
    60 minutes · Intermediate
  2. FortiWeb Lesson 07: Attack Signatures, SQL Injection and XSS
    60 minutes · Intermediate
  3. FortiWeb Lesson 08: URL Access, HTTP Methods and Parameter Validation
    75 minutes · Intermediate
  4. FortiWeb Lesson 09: HTTP Constraints, Cookies and File Upload Controls
    60 minutes · Intermediate
  5. FortiWeb Lesson 10: Machine Learning, Baselines and Model Quality
    75 minutes · Intermediate to advanced
  6. FortiWeb Lesson 11: Attack Logs and Evidence-Based Troubleshooting
    60 minutes · Intermediate
  7. FortiWeb Lesson 12: Tune False Positives with Scoped Exceptions
    75 minutes · Intermediate

Advanced controls and operations

  1. FortiWeb Lesson 13: JSON, XML and OpenAPI Protection
    75 minutes · Intermediate to advanced
  2. FortiWeb Lesson 14: Login Security, CSRF, Bot Mitigation and DoS
    90 minutes · Advanced
  3. FortiWeb Lesson 15: Production Rollout, Backups and High Availability
    90 minutes · Advanced
  4. FortiWeb Lesson 16: Automation, Configuration Review and Upgrade Planning
    75 minutes · Advanced
  5. FortiWeb Lesson 17: Capstone — Build, Tune, Troubleshoot and Recover
    120 minutes · Advanced practical assessment

What you will practice

Build a traffic path, configure server policies and profiles, understand actions and scan order, evaluate signatures and constraints, investigate logs, tune scoped exceptions, protect APIs, evaluate automation abuse, and validate recovery. The final capstone asks for evidence rather than screenshots of checkboxes.

Explore the separate F5 ASM training block · Meet your instructor

Independent educational series, not affiliated with Fortinet. Lab instructions describe expected behavior and have not been executed on a FortiWeb appliance for this publication. Operational mastery requires continued practice.

Comments

Post a Comment

Popular posts from this blog

PHP2Shell Explained: Impact, Patches and Mitigation for CVE-2026-109618 and CVE-2026-109619

By Harpreet Singh Virdi, CISSP, CCSP · Cybersecurity Updates Published and evidence checked: November 3, 2026. If you run PHP, start with an inventory and a patch decision today. If a security appliance uses PHP internally, check its vendor advisory too. Updating your website code alone does not update the runtime inside a firewall. PHP2Shell is the name used for CVE-2026-109618 and CVE-2026-109619. They can allow remote code execution without authentication. PHP released security updates on October 21. The PHP team identifies web-serving installations as at risk and highlights Apache mod_php as the highest-risk configuration. PHP security announcements .
Read more

Start Here: F5 ASM Classroom — From Beginner to Advanced

WELCOME TO YOUR ONLINE CLASSROOM Learn F5 ASM, one clear lesson at a time. A practical English-language course for beginners, progressing to advanced policy operations. Instructor: Harpreet Singh Virdi, CISSP, CCSP Start here — you do not need prior ASM experience If the words “security policy,” “staging,” and “learning suggestion” feel unfamiliar, you are in the right place. We will explain them carefully, follow a web request through BIG-IP, and build a policy around a fictional online bookshop. F5 ASM means BIG-IP Application Security Manager. It inspects application traffic against configured security checks. The course explains how to use those checks, investigate their results, and protect legitimate user journeys. Advanced WAF terminology also appears; feature availability depends on your release and license. How to take this course Read the lessons in numerical order. Each is a separate blog post. Learn the terms, then work through the example before changing settings. Use an ...
Read more

Lesson 01: What Is F5 ASM? Your First Web Application Firewall Class

F5 ASM CLASSROOM • LESSON 01 Level: Beginner  |  Suggested study and lab time: 30 minutes Instructor: Harpreet Singh Virdi, CISSP, CCSP Start Here / Course Guide · All lessons Welcome to class Imagine running an online bookshop. Your website must accept searches, logins, and orders from people you have never met. The same public entrance also receives malformed requests and attempts to exploit software weaknesses. How do you distinguish a normal search from a suspicious request? A web application firewall (WAF) examines web traffic using rules about the application and patterns associated with attacks. F5 BIG-IP Application Security Manager, usually called ASM , is a WAF capability on the BIG-IP platform. Our task is to understand the traffic, define appropriate checks, investigate the results, and enforce protection without unnecessarily disrupting legitimate users. What you will learn Explain the purpose of a WAF in your own words. Identify where ASM fits in a web reque...
Read more