* On VM models, acceleration is due to offloading the cryptography burden from the back-end server. On hardware models, cryptography is also hardware-accelerated via ASIC chips.
FortiWeb significantly reduces deployment costs by consolidating WAF, hardware acceleration, load balancing, and vulnerability scanning into a single device with no per-user pricing. Those features drastically reduce the time required to protect your regulated, Internet-facing data and eases the challenges associated with policy enforcement and regulatory compliance.
Architecture
Figure 1: Basic topology
Scope
FortiWeb can be deployed in a one-arm topology, but is more commonly positioned inline to intercept all incoming clients’ connections and redistribute them to your servers. FortiWeb has
TCP- and HTTP-specific firewalling capability. Because it is not designed to provide security to non-HTTP applications, it should be deployed behind a firewall such as FortiGate that focuses on security for other protocols that may be forwarded to your back-end servers, such as FTP and SSH.
Once the appliance is deployed, you can configure FortiWeb via its web UI and CLI, from a web browser and terminal emulator on your management computer.
This document describes how to set up your FortiWeb appliance. For both the hardware and virtual appliance versions of FortiWeb, it describes how to complete first-time system deployment, including planning the network topology.
It also describes how to use the web user interface (web UI), and contains lists of default utilized port numbers, configuration limits, and supported standards.
This document assumes, if you have installed the virtual appliance version (FortiWeb-VM), that you have already followed the instructions in the
FortiWeb-VM Install Guide
.
Fortinet 14 FortiWeb 5.2 Patch 2 Administration Guide
After completing
“How to set up your FortiWeb” on page 65
:
• You will have administrative access to the web UI and/or CLI.
• You will have completed firmware updates, if any.
• The system time, DNS settings, administrator password, and network interfaces will be configured.
• You will have set the operation mode.
• You will have configured basic logging.
• You will have created at least one server policy.
• You may have completed at least one phase of auto-learning to jump-start your configuration.
Once that basic installation is complete, you can use the rest of this document to use the web UI to:
• Update the FortiWeb appliance.
• Reconfigure features.
• Use advanced features, such as anti-defacement.
• Diagnose problems.
This document does not provide a reference for the command line interface (CLI). For that information, see the
FortiWeb CLI Reference
.
This document is intended for administrators, not end users. If you are accessing a web site protected by FortiWeb, please contact your system administrator.
Fortinet 15 FortiWeb 5.2 Patch 2 Administration Guide
What’s new
The list below contains features new or changed since FortiWeb 5.0 Patch 4. For upgrade
information, see the Release Notes available with the firmware and “Updating the firmware” on page 85
.
FortiWeb 5.2 Patch 2
• FortiWeb-VM on demand on Amazon Web Services (AWS)-VM01 — In addition to running FortiWeb-VM on AWS using a license you own, you can use Amazon’s EC2 console to deploy FortiWeb-VM on an hourly basis.
On-demand/hourly FortiWeb-VM from AWS includes a fully-licensed instance of
FortiWeb-VM, all FortiGuard services, and technical support.
• Default password for FortiWeb-VM on AWS — When you deploy FortiWeb on AWS, the admin administrator has a default password, which is the AWS instance ID.
For more information on deploying FortiWeb-VM on AWS, see the
FortiWeb-VM Installation
Guide
.
FortiWeb 5.2 Patch 1
• FortiWeb-VM01— This new FortiWeb-VM version supports 1 virtual CPU.
• FortiWeb-VM support for Microsoft Hyper-V — You can now deploy FortiWeb-VM as a
Hyper-V virtual machine.
For more information on FortiWeb-VM features, see the
FortiWeb-VM Installation Guide
.
FortiWeb 5.2
• New Advanced Protection custom rule filter types — The new filter types provide more sophisticated detection of complicated attacks. In addition, new predefined rules such as crawler, scanning, and slow attacks based on these new capabilities have been added. See
“Combination access control & rate limiting” on page 343
.
• Administrative access for VLANs — You can now allow administrative access to virtual local area network (VLAN) subinterfaces. See
“Adding VLAN subinterfaces” on page 125 .
• ADOM certificate management — When you create administrative domains (ADOMs), certificate configuration options are now located in the menu for each administrative domain, instead of the Global menu. This allows each administrative domain to have its own certificates and certificate-related settings. See
“Administrative domains (ADOMs)” on page 45 .
• Specify IP ranges for URL Access Rule and IP List — When you configure access control by URL or a blacklist or whitelist, in addition to specifying a single IP address, you can now
Fortinet 16 FortiWeb 5.2 Patch 2 Administration Guide
Fortinet also specify a range of IP addresses. See
“Restricting access to specific URLs” on page 339
and
“Blacklisting & whitelisting clients using a source IP or source IP range” on page 353
.
• Attack and traffic logs and reports
• Attack logs now contain Source Country, Signature ID, and Signature Subclass Type fields. Traffic logs now contain a Source Country field. See
“Viewing log messages” on page 587 .
• When you view the attack and traffic log messages in the web UI, in the Source column, a flag icon beside the IP address indicates the country associated with the address. See
“Viewing log messages” on page 587 .
• FortiWeb now has new report types that capture traffic and attack activity by source country and attack signature. See
“Choosing the type & format of a report profile” on page 625 .
FortiWeb 5.1 Patch 4
• No design changes. Bug fixes only.
FortiWeb 5.1 Patch 3
• Caching — To improve performance of your back-end network and servers by reducing their traffic and processing load, you can now configure FortiWeb to cache responses from your servers.. See
“Caching” on page 399
.
• Enhanced resource monitoring— The dashboard now shows disk usage for the hard disk used to store logs and reports. See
“System Resources widget” on page 566
.
• Increased limits for physical and virtual servers — The maximum number of physical and/or virtual servers per ADOM has been increased to 1,024.
FortiWeb 5.1 Patch 2
• Server-controlled load balancing — FortiWeb can now load balance traffic based upon cookies embedded by your back-end servers, the URL, host name, or all of those.
This can provide better HTTP session persistence, as well as enabling servers to control their own load levels, which can be useful if your servers are sometimes busy with other,
non-HTTP services or applications. See “Routing based upon URL, cookie, or “Host:” name” on page 275
.
• Padding oracle attack protection — For web applications that selectively encrypt inputs without using HTTPS, FortiWeb can now protect vulnerable block cipher implementations.
See “Defeating cipher padding attacks on individually encrypted inputs” on page 429 .
• X-Forwarded-For: support for Geo IP — Blocking clients based upon their geographical location now can be done based upon the IP address that FortiWeb extracts from an HTTP
X-header, not only the the IP layer. This improves feature support for deployments where a
load balancer is placed in front of FortiWeb. See “External load balancers: before or after?” on page 66 .
• Protocol constraint limits increased — Constraint defaults now are increased to match the size of the buffer for FortiWeb’s HTTP parser. Size varies by your model of FortiWeb. See
“HTTP/HTTPS protocol constraints” on page 463
.
• Aggregation indicated in log messages — Attack logs that are recorded during DoS or padding oracle attacks are not recorded individually, but rather periodically while the attack is ongoing, even if that attack is from multiple source IPs. This prevents attack logs flooded with identical or very similar messages. To differentiate logs that are caused by individual attacks or by multiple attacks in the same category, attack log messages now mention when
17 FortiWeb 5.2 Patch 2 Administration Guide
Fortinet there have been multiple signatures matched per message, and will group attacks in the same category into a single log message. See the
FortiWeb Log Reference
.
• Protected Servers changed to Protected Host Names — To better indicate their usage,
FortiWeb now refers to these configuration objects as allowed/protected host names. See
“Defining your protected/allowed HTTP “Host:” header names” on page 260
.
FortiWeb 5.1 Patch 1
• No design changes. Bug fixes only.
FortiWeb 5.1
• Administrative domains (ADOMs) — Similar to FortiGate VDOMs, FortiWeb now supports assigning administrator logins to separate domains, each with its own separate policies so that it cannot see or impact the other domains’ settings. This is ideal for larger enterprises and multi-tenant deployments. See
“Administrative domains (ADOMs)” on page 45
.
• HTTP pipelining support — For clients that support HTTP 1.1, HTTP pipelining can now be used to accelerate transactions by bundling them in the same TCP connection, and by not waiting for a response before sending/receiving the next request. This can increase performance when pages containing many images, scripts, and other auxiliary files are all
hosted on the same domain, and therefore could use the same connection. See “HTTP pipelining” on page 524
.
• RADIUS vendor-specific attributes for access profiles — If your administrator accounts authenticate via a RADIUS query, you can assign their access profile using RFC 2548
Microsoft Vendor-specific RADIUS Attributes. See
Access Profile
in “Administrators” on page 221
and
“Configuring RADIUS queries” on page 242 .
• Same server farm for multiple virtual servers — If your topology requires that you forward traffic from multiple virtual servers to the same back-end server farm, you can now do this without chaining policies. See
“Configuring virtual servers on your FortiWeb” on page 288
and the
Server Farm
setting.
• HSTS header support — To prevent your users from accidentally accessing sensitive websites via unsecured HTTP instead of the intended HTTPS site, you can now configure
policies to add the strict transport security header to HTTPS requests. See “How to force clients to use HTTPS” on page 310
and
Add HSTS Header
in
“Configuring a server policy” on page 509
.
• Expanded IPv6 support — More features now support IPv6, including HSTS and
X-Forwarded-Proto:
headers. See
“Defining your proxies, clients, & X-headers” on page 281
and
“How to force clients to use HTTPS” on page 310 .
• Enhanced attack log aggregation— Aggregated attack logs are now available from a
submenu and have been enhanced. See “Coalescing similar attack log messages” on page 606
.
18 FortiWeb 5.2 Patch 2 Administration Guide
FortiWeb 5.0 Patch 4
• Bulk edits for parameter validation rules — Rather than individually editing each rule, you can now replace the Action, Trigger Policy, and/or Severity of multiple rules simultaneously.
See “Bulk changes to input validation rules” on page 451
.
• Regular expressions for site publishing — To support quickly publishing the same web applications for multiple subdomains, regular expression support has been added. See
“Single sign-on (SSO)” on page 253
.
• Namibian time zone support — System time and date settings now support the Namibian time zone. See
“Setting the system time & date” on page 99 .
• Enlarged HTTP argument buffer support — The maximum buffer size for parameters when scanning can now be up to 64 KB. For details, see the
FortiWeb CLI Reference
.
• Data types added — New predefined data types have been added to match postal codes from Sweden and Quebec, as well as Italian mobile phone numbers. See
“Predefined data types” on page 175
.
Documentation enhancements
Maximum values for ADOMs have been added. See “Appendix B: Maximum configuration values” on page 702 .
Deployments involving external load-balancing and SNAT devices such as FortiADC and
FortiBalancer now have specific topology advice. See
“External load balancers: before or after?” on page 66
. Diagrams have also been added to expand on one-arm topologies, most commonly used when the back-end servers also offer other services such as SFTP or SSH. See
Figure 14 on page 72
.
Fortinet 19 FortiWeb 5.2 Patch 2 Administration Guide
