Configuring basic policies
As the last step in the setup sequence, you must configure at least one policy.
Until you configure a policy, by default, FortiWeb will:
• while in reverse proxy mode, deny all traffic (positive security model)
• while in other operation modes, allow all traffic (negative security model)
Once traffic matches a policy, protection profile rules are applied using a negative security model — that is, traffic that matches a policy is allowed unless it is flagged as disallowed by any of the enabled scans.
Keep in mind:
• Change policy settings with care. Changes take effect immediately after you click OK.
• When you change any server policy, you should retest it.
• FortiWeb appliances apply policies, rules, and scans in a specific order. This decides each
outcome. (See “Sequence of scans” on page 21 .) Review the logic of your server policies
to make sure they deliver the web protection and features you expect.
This section contains examples to get you started:
•
Example 1: Configuring a policy for HTTP via auto-learning
•
Example 2: Configuring a policy for HTTPS
•
Example 3: Configuring a policy for load balancing
Once completed, continue with “Testing your installation” on page 210
.
Example 1: Configuring a policy for HTTP via auto-learning
In the simplest scenario, if you want to protect a single, basic web server (that is, it does not use HTTPS) while the FortiWeb is operating as a reverse proxy, you can save time configuring your policy by using the auto-learning feature.
To generate profiles and apply them in a policy
1. Create a virtual server on the FortiWeb appliance (Server Objects > Server > Virtual Server).
When used by a policy, it receives traffic from clients.
2. Define your web server using its IP address (Server Objects > Server > Physical Server) or domain name (Server Objects > Server > Domain Server). When used by a policy, a physical or domain server defines the web server’s IP address to which accepted client traffic will be forwarded.
Fortinet 157 FortiWeb 5.2 Patch 2 Administration Guide
Fortinet
3. Create a new policy (Policy > Server Policy > Server Policy).
• In Name, type a unique name for the policy.
•
In
Virtual Server
or
Data Capture Port
, select your virtual server.
•
In
HTTP Service
, select the predefined HTTP service.
•
In
Physical Server
, select your physical server.
•
In
Physical Server Port
, if your web server does not listen on the standard port 80, type its port number for incoming HTTP traffic.
• From
WAF Auto Learn Profile
, select the predefined auto-learning profile.
• From
Web Protection Profile
, select one of the predefined inline protection profiles.
When you use an auto-learning profile, any inline protection profile that you use with it should have
Session Management
enabled.
Traffic should now pass through the FortiWeb appliance to your server. If it does not, see
“Troubleshooting” on page 663
. Auto-learning gathers data based upon the characteristics of requests and responses that it observes.
4. Use the auto-learning report to determine whether auto-learning has observed enough
URLs, parameters, and attacks (Auto Learn > Auto Learn Report > Auto Learn Report; see
“Auto-learning” on page 160 ).
5. Generate an initial configuration (Auto Learn > Auto Learn Report > Auto Learn Report then click Generate Config).
6. If necessary, modify the generated profiles to suit your security policy.
7. Modify the policy to select your generated profile in
Web Protection Profile
.
8. Disable auto-learning by deselecting the auto-learning profile in
WAF Auto Learn Profile
.
Example 2: Configuring a policy for HTTPS
If you want to protect a single HTTPS web server, and the FortiWeb appliance is operating in reverse proxy mode, configuration is similar to
Example 1: Configuring a policy for HTTP via auto-learning . (Optionally, you can configure a server policy that includes both an HTTP service
and an HTTPS service.)
To be able to scan secure traffic, however, the FortiWeb appliance must also be configured to decrypt it, and therefore must be provided with the server’s certificate and private key.
To configure an HTTPS policy
1. Upload a copy of the web server’s certificate (System > Certificates > Local).
2. Configure a policy and profiles according to
“Example 1: Configuring a policy for HTTP via auto-learning” on page 157 , except for auto-learning, which you will postpone until these
steps are complete.
158 FortiWeb 5.2 Patch 2 Administration Guide
Fortinet
3. Modify the server policy (Policy > Server Policy > Server Policy).
•
In
HTTPS Service
, select the predefined HTTPS service.
•
In
Physical Server Port
, if your web server does not listen on the standard port 443, type its port number for incoming HTTPS traffic.
•
In
Certificate
, select your web server’s certificate. Also select, if applicable,
Certificate
Verification
and
Certificate Intermediate Group .
• Enable
SSL Server
.
Traffic should now pass through the FortiWeb appliance to your server. If it does not, see
“Troubleshooting” on page 663
.
Example 3: Configuring a policy for load balancing
If you want protect multiple web servers, configuration is similar to
Example 1: Configuring a policy for HTTP via auto-learning .
To distribute load among multiple servers, however, instead of specifying a single physical server in the policy, you must specify a group of servers (server farm).
This example assumes a basic network topology. If there is another, external proxy or load balancer between clients and your FortiWeb, you may need to define it (see
“Defining your web servers & load balancers” on page 259 ).
Similarly, if there is a proxy or load balancer between FortiWeb and your web servers, you may need to configure your FortiWebserver policy’s
Deployment Mode
option as if requests were destined for a single web server (the proxy or load balancer), not load balanced by FortiWeb amongst multiple servers.
To configure a load-balancing policy
1. Define additional web servers by either their IP address (Server Objects > Server >
Physical Server) or domain name (Server Objects > Server > Domain Server).
2. Group the web servers into a server farm (Server Objects > Server > Server Farm). When used by a policy, it tells the FortiWeb appliance how to distribute incoming web connections to those destination IP addresses. On the Server Farm dialog:
• From
Type
, select Server Balance.
•
Add your physical and/or domain servers (
Physical Server
or
Domain Server
).
• If you want to distribute connections proportionately to a server’s capabilities instead of
evenly, in each
Weight
, give the numerical weight of the new server when using the weighted round-robin load-balancing algorithm.
3. Configure a policy and profiles according to
“Example 1: Configuring a policy for HTTP via auto-learning” on page 157 , except for auto-learning, which you will postpone until these
steps are complete.
4. Modify the server policy:
• From
Deployment Mode
, select Server Balance.
• From
Load Balancing Algorithm
, select Round Robin or Weighted Round Robin.
Traffic should now pass through the FortiWeb appliance and be distributed among your servers. If it does not, see
“Troubleshooting” on page 663 .
159 FortiWeb 5.2 Patch 2 Administration Guide
