Index
Symbols
.pfx 323
<form> 444, 453
<input> 444, 453
<object> 426
<script> 426, 427
Numerics
113, error 80, 686
200 OK 267, 522
239.0.0.1 40
2-way authentication 310
301 Found 382
301 Moved Permanently 382, 537
302 Found 382, 453, 540
302 Moved Temporarily 382, 453, 537, 539
3DES 80, 82, 553
400 Bad Request 522
401 Authorization Required 230, 231, 235, 236, 540
401 Unauthorized 160, 200, 539
403 Access Forbidden 500
403 Forbidden 200, 379, 382, 408, 422, 440, 448, 456,
501, 522
404 File Not Found 200, 501
404 File Note Found 522
500 Internal Server Error 160, 200, 522
501 Not Implemented 522
70007 353
802.3ad 129
A
accept 200, 345, 361, 364, 368, 371, 407, 421, 430,
521
Accept-Encoding: 25
access control
FortiWeb 56, 225, 226
to your servers 339
access profile 52, 55, 225, 226, 643
ACK 36, 267, 372
action
in reports 624
message format (AMF) 497, 506
when traffic violates policy 407, 488
Active Directory 221, 238, 241, 245, 253, 323, 325
active role 44
active-active 76, 115
active-passive 75, 76, 106
ActiveSync 13
Fortinet 717
address resolution protocol (ARP) 114, 133, 699
and HA 656
and virtual servers 685
extra packets 114 gratuitous 114
table 675 troubleshooting 675
administrative access 57
interface settings 123, 127 protocols 123, 125, 127
restricting 56, 123, 125, 127, 221, 224
to web servers 181
administrator
"admin" account 55, 80, 82, 83, 98, 632 account 88, 92, 93, 94, 155, 632
domain (ADOM) 45, 702
domains (ADOMs) 52
password 98, 223
permissions 98
trusted host 224
Adobe
ColdFusion 231, 526, 654
Flash 28, 50, 191, 405, 497, 506, 646
Flex 497, 506
ADOM 116
advanced persistent threat (APT) 20, 349, 636
AES 80, 82, 216, 218, 296, 297, 553, 602
aggregation
link 129
log messages 582, 606
AJAX 23, 488, 498, 506, 526
Akamai 287
alert
on the dashboard 608
vulnerability scan 546
alert email 200, 340, 345, 361, 364, 368, 371, 407,
408, 421, 422, 430, 431, 440, 448, 456, 466, 478,
497, 521, 572, 608, 699
enabling 529, 608
for end-user HTTP authentication 252, 257
reducing 211
severity 341, 346, 351, 355, 362, 365, 369, 371,
376, 409, 422, 431, 436, 441, 449, 457, 460,
467, 478
algorithm
link aggregation 131
load balancing 515
SSL/TLS 296
allow 196, 340, 408
method 459
exception 461
alphanumeric 178
American Express 177
Android 233, 311
FortiWeb 5.2 Patch 2 Administration Guide
anonymous
Diffie-Hellman 686
FTP 217
proxy 348
query 240
requests 350
VPN 32, 350
ANSI escape code 178
anti-defacement 526, 636, 699, 700
performance 655
Apache 13, 182, 186, 469, 474
DoS 469
Slowloris attack 34
virtual host 260
Apple
iPhone 233, 311
Mac OS X 30, 679, 684
application layer 138, 139, 295, 356, 372, 488, 676
architecture 14
archive 629
ASCII 667, 711, 713, 714
ASIC chip 14, 294, 550
ASP 526
.Net 424
ASPSESSIONID 505
asterisks 584
and performance 649
asymmetric
encryption 312
routing 676
asynchronous inspection 502
attachment 629
attack
analytics 631, 632
BEAST 553
block 196, 200, 340, 345, 361, 364, 368, 371, 407,
412, 421, 430, 440, 448, 456, 466, 478
brute force encryption 429
brute force login 28, 81, 84, 224, 311
buffer overflow 464
clickjacking 393
console 566
count in auto-learning report 200
CRIME 37
CSRF 29, 433
denial of service (DoS) 553
distributed (DDoS) 32
directory
traversal 428
DoS 29, 350, 356
hidden input tampering 453
HTTP request flood 365
information leak 31
log 200, 341, 345, 346, 351, 355, 361, 362, 364,
365, 368, 369, 371, 376, 407, 409, 421, 422,
430, 431, 436, 440, 441, 448, 449, 456, 457,
460, 466, 467, 478, 521, 566, 577
in PDF format 606
search 603
LOIC 33 low-rate DoS 33
Lucky 13 429
man-in-the-middle (MITM) 295, 310, 313
padded 646
padding oracle 429
ping 124, 128
redirect 200, 407, 422, 440, 448, 456
report page 197
session hijacking 386
signature 405, 419, 645
slow
brute force 253
POST 33
slowloris 34 socket exhaustion 34
SQL injection 32
statistics 501, 508
SYN flood 34
tampering 453
XML parser 498, 506
XSS 29
zero-day 419, 444
Zeus 33
attribute
certificate 314
common name (CN) 239
extended 314
filter 240
group membership 238, 241
HTML 445, 449 name 449
RADIUS 18, 225, 245
type 445
XML 498, 506
Attribute 31 245
audit 221, 226, 636
authentication 80, 234, 243, 248
administrator 222
end-user 70, 230
failure 241
form-based 234, 536, 540
local 222
mutual 310
PKI 233, 310, 520
remote 221
SMTP 609
SSL/TLS 686
supporting modes 74, 75
timeout 250
URL 540
vulnerability scan 537, 539
Authorization 256
authorization 23, 230, 243
bypassing 36
end-user 234
FortiGuard 155
Fortinet 718 FortiWeb 5.2 Patch 2 Administration Guide
Authorization: 235, 256, 404
auto ID 309
auto-learning 157, 160
and performance 648
clear data 209
performance 652
profile generate 205
reports 191
availability 105, 572
B
back door 203, 532
backbone 129
back-end server 526
back-reference 164, 204, 381, 382, 395, 705, 709
and performance 649 backtracking 649
backup 661
firmware 93
password 642
secure 312, 317, 320, 323
web site 531
bandwidth 129
bank sort code 179
Base64 256, 324, 427
baseline 215, 566
batch configuration 219
BCOPY 460, 463
BEAST 28, 553
best practices 13, 137, 189, 555
binary 405, 506
bind DN 240
Bing 186
BIOS 694
bit
DF 666
mask 127
strength 80, 82, 216, 218, 296, 297, 313, 602
TOS 666
bits per second (bps) 82
blacklist 353, 354, 639
block 203
IP 639
period 200, 345, 361, 364, 368, 371, 407, 408, 421,
422, 430, 431, 440, 448, 456, 466, 478, 639
example 362
Blowfish 82
body rewrite 379, 393
boot
device 696 interrupt 696
loader 694
up 693
botnet 143, 348, 350
boundary 706
bridge 43, 69, 73, 120, 135, 487, 516, 550
protocol data unit (BPDU) 132
topology 73
broadcast 114, 120, 129
domain 125
browser 78, 80, 124, 220, 274, 520
access 50
attack 426
enforcement 360, 367
error handling 426
resolution 50
warnings 81
brute force
encryption 429
login
FortiWeb 81, 84, 224
web server 375
buffer
compression inspection 148 decompression 148
DLP scan 552
length 464, 564, 565
overflow 30, 444, 464, 467, 470, 538
packet log 578
pad 646
size 190, 464, 470, 645
bypass 72, 74, 289
during power outage 550
using anonymous Diffie-Hellman 686
C
cabling 676
cache
authentication query results 252
browser 89, 94, 231, 236
clear 236
content 69
omitted 404
performance 401
improving performance 17, 399
no 404
realm 236
response 552
timeout 252
Cache-Control: 404
CalDAV 459, 467
capture group 164, 381, 395, 705, 709
and performance 649
carriage return 705
Carte Blanche 177
cascading style sheet (CSS) 554
Fortinet 719 FortiWeb 5.2 Patch 2 Administration Guide
certificate 273, 294, 519
authority (CA) 81, 297, 302, 303, 306, 308, 313,
334, 336 field 334
chain of trust 333
client 334
default 81, 300
domain name 81
local 300
mismatch 81
operation modes 306
personal 233, 273, 310, 334, 520 revocation list (CRL) 334, 336, 337
upload 336
revoke 333, 334, 336
self-signed 80
server 300
signature 314, 333
signing chain 274, 306, 321, 520
signing request (CSR) 301
generating 302
generating in Microsoft Windows Server 316
submit 305
trust 274, 306, 520
trust store 317, 323, 325
user 273, 520
verification 69
warning 81, 274, 308, 520
CFG_CLI_INTERNAL_ERR 141, 142
chain of trust 274, 306, 312, 321, 333, 520
channel 129
character
class 650
encoding 427, 552
property 650
set 427 special 427 charset 427
checksum
data analytics file 632
header 666
message authentication 313
Chinese 58
chip
ASIC 14
Chrome 210, 296, 310, 553, 686
chunk 404
chunked 379
CIFS 528, 530, 699, 700
cipher 82, 530
suite 686
cipher block chaining (CBC) 296, 297, 429, 553
Cisco discovery protocol (CDP) 126
clean install 696
clickjacking 29, 393, 658
Client Authentication 335
client certificate 233
cloaking 379, 408, 412, 421
clock 100, 560
cluster 40, 42, 70, 92, 105, 108, 268
Fortinet 720
cmd.exe 428
code point 708
ColdFusion 231, 412, 654
color 178, 565, 635
column view, logs 596
command line interface (CLI) 15, 56, 78, 101, 103,
221, 556, 564, 700 commands 564
connecting to 81
Console widget 557, 564
diagnose 675 network 675
prompt 549
through the web UI 556
using to debug 686
comma-separated value (CSV) 585, 602
comment 712
common
gateway interface (CGI) 36, 455
name (CN) 81
ID (CNID) 239
community 614
name 615
SNMP 612
Comodo 313, 314
compliance 14, 212
HIPAA 28
PCI DSS 29, 533, 626
compression 13, 69, 481
config 226
connecting
CLI 81
web UI 80
connection
layer 488
limits 362
load balancer 407
reset 408
Connection: 404, 524
contact information, SNMP 613
content
routing 268
HTTP 268, 275, 515
scraper 413
Content-Encoding: 24, 481, 484
Content-Length: 23, 33, 404, 467, 475
Content-Type: 23, 384, 475, 479, 482, 484, 485
cookie 22, 23, 160, 212, 232, 496, 497
crumb 204
limit 646
session 35, 37, 232, 356, 434, 488
stolen 434
support 357, 362, 496, 497
SYN 372, 517
tampering 29
third-party 212
web application 39, 232
whitelisted 488
Cookie: 24, 38, 401, 422
cookiesession1 23, 38, 488
FortiWeb 5.2 Patch 2 Administration Guide
country 350
code 177
CP7 chip 550
CP8 294
CPU
and ASIC chip 550
usage 566, 578, 617, 618, 687
and regular expressions 648
versus ASIC processing 294
crack 178
crawler 541
credit card
leakage 29
number 177, 178, 414
CRIME 37
crossover cable 75, 107
cross-site request forgery (CSRF) 29, 409, 433
cross-site scripting (XSS) 13, 29, 31, 150, 405, 409,
497, 506, 538, 567
writing signatures for 425
custom
dashboard 556
data type 452
network service 290
signature 420
suspicious URL 183, 184
D
Danish postnumre 177
dashboard 555
customize 556
data
analytics 631, 632
capture port 516
leak 29, 405, 414
signature 419
leak prevention (DLP) 420, 484
loss 572
sensitive 584
theft 30, 31
type 452
and regular expressions 175 custom 175
group 180
predefined 175
data leak protection (DLP) 552
database 212
dates 177
daylight saving time (DST) 100
debug command 686
decrypt 518, 519
defacement 20, 526, 655
Fortinet 721 default
access profile 226, 643
administrator account 55, 80, 82, 83, 88, 92, 93,
94, 98, 155, 632
ADOM 48
certificate 81
configuration 221
IP address 119
password 15, 80, 81, 82, 83, 84, 98, 228, 689
reset to 695
route 135
settings 80, 82, 565
URL 80, 124, 220
widgets 557
Deflate 37
delete
cannot 226
logo 622
logs 662
packet payload data 572
policy 62, 102, 103
route 102, 103
VLAN 102, 103
V-zone 102, 103
denial of service (DoS) 13, 32, 69, 350, 356, 469, 474,
553
and ping 677
distributed 32
false positive 657
prevention policy 373
SYN flood 517
vulnerability scan 534, 539
deny 196, 200, 340, 345, 361, 364, 368, 371, 407, 412,
421, 430, 440, 448, 456, 466, 478
deployment 20, 65
mode 515
DES 80, 296, 297
destination
NAT 150
destination unreachable 137, 681
diagnose 666, 675, 685
diff 665
differentiated services 666
Diffie-Hellman 70, 210
exchange 272, 686
digest 497
Digital Signature 335
Diners Club 177
directory 235
traversal attack 30, 428
disk
failure 572, 573
full 691
quota 586
space 209, 566, 602
status 571
usage 566, 617, 691
distinguished name (DN) 238, 240, 241, 301
bind 240
document object model (DOM) 453, 498
FortiWeb 5.2 Patch 2 Administration Guide
document type definition (DTD) 498
domain
Active Directory 325
administrative (ADOM) 45, 52, 702
authentication 235
broadcast 125
name 711
certificate 81
FTP server 217
fully qualified (FQDN) 682
local 140, 141, 549
name system (DNS)
119
internationalized 711
query 139
records 71
server 139, 140, 609
test connection 681
settings 139
virtual (VDOM) 53
Domino 13, 221, 238
DOS 78
dot3Errors 618 dot3Tests 618
down 569
link 570
time 42, 266, 280
downgrade 87
download
certificate 305
logs 600
reports 630
DSA 306
DTD 712
dual ISP connection 106
duplex 129, 570
dynamic
pages 231
URL 160, 161, 190, 193, 404
E
ECHO_REQUEST 124, 128, 265, 267, 676, 677
ECHO_RESPONSE 124, 128, 267, 586, 675, 677
ECMP 677
eDirectory 238, 241
EGP 618
egress 137
element
HTML 712
XML 498, 506
email
address 177
alert 529, 608 policy 608
Fortinet 722
encoding 58, 427, 713
Base64 256
chunked 404
hexadecimal 190
international domain name (IDN) 713
transfer 379
URL 190, 552
encryption 519, 686
backup 216, 218, 602
password 642
SSL/TLS 296, 429
weak 80
end-user 236
EnhancedKeyUsage 335
enRoute 177
entity 427, 712
ephemeral Diffie-Hellman 272
erase 408
error 686
113 80, 686
invalid IP address 133
page, custom 491
server 412
syntax 470
ERROR_SSL_VERSION_OR_CIPHER_MISMATCH
80, 686
escape codes 178
Ethernet 80, 83, 179, 618, 667
frame 129
event
console 212, 556
log 252, 257, 578
SNMP 617
exception
allow method 461
compression 480
HTTP protocol constraint 471
Exchange Server 13, 165, 460, 463
execute shutdown 63
exploit 181
extended signature set 211
ExtendedKeyUsage 335
F
factory default settings 80, 82, 221, 695
fail-open 69, 108, 550
failover 39, 40, 41, 42, 92, 106, 107, 108, 111, 133
fail-to-wire 69, 108, 550
failure
PSU 550
false
negative 578, 660
FortiGuard 149
positive 186, 188, 189, 190, 211, 213, 359, 409,
410, 411, 412, 416, 419, 421, 470, 471, 578,
593, 639, 646, 658, 660
FortiGuard 149
fault tolerance 105, 106, 108, 550
favicon.ico 488, 489
FortiWeb 5.2 Patch 2 Administration Guide
file
compression 69, 484
defacement 530
size limit 529
extensions 655
formats 629
large 655
name 629
password 642
size 482, 631
limit 475, 476
type
restriction 475, 476 upload 476 limit 476
file system check 692
filter
clear 599, 600
icon 598
LDAP query 240
logs 598
fingerprint 428
server software 491
SSH 83
Firefox 80, 310, 428, 553, 686
Firesheep 37, 386
firewall 641
blocking FortiWeb 681
conventional 66
generic 354, 488
standby 106
firmware 85
alternate 93
change 558
downgrade 87
restore 696
test 85
update 87 upgrade 87
version 556, 560
first-time system setup 14
flag 666
Flash 28, 191, 405, 497, 506, 646
Flex 497, 506
flood
HTTP request 365, 369
TCP connection 365, 369
TCP connections 362
TCP SYN (half-formed connection) 372
flow control 83
font 565
footer 621
forensic analysis 348, 349, 393, 428, 578, 593
forgotten password 228, 689
form 234, 445, 454, 540
submit 232
tag 231
Fortinet 723 format
boot device 696
reports 625
view, logs 596
FortiADC 66, 115
FortiAnalyzer 582, 587
log storage 575
policy 585
FortiBalancer 66
FortiGuard
Antivirus 143
FortiWeb Security Service 143
IP Reputation Intelligence Service (IRIS) 143, 348
services 65
updates 149, 150
Vulnerability Management 143
FortiMail 609
Fortinet
Distribution Network (FDN) 143
Technical Support 107, 143, 618
registering with 65
FortiScan 533, 640
FortiWeb
1000C 550, 692
1000D 571
3000C 550, 571
3000CFSX 550
3000CFsx 571
3000D 571
3000DFsx 571
4000C 550
4000D 571
FortiWeb-VM 64, 65, 80, 105, 119, 132, 571
forwarding 66, 268, 488
FTP 72, 292
HTTP 260, 292
fragment 666
frame 125, 129, 131
fraud 37
FTP 72, 73, 179
and anti-defacement 528, 699
backup via 217
forwarding to servers 72
fully qualified domain name (FQDN) 304
fwb_system.conf 41
G
gateway 103, 119, 137, 138 route 137
GB2312 713
generate
auto-learning PDF 195
auto-learning profile 205
Generic Attacks 410
geography 350
GET 208, 260, 267, 524, 538
get 226, 549
gidNumber 241
FortiWeb 5.2 Patch 2 Administration Guide
Google
Analytics 488
Android 233, 311
Chrome 210, 231, 235, 296, 310, 333, 553, 686
search engine crawler 186
government regulations 13
grade point average (GPA) 177
graphical user interface (GUI) 50, 78
gratuitous ARP 114
greedy 707
greyware 411
group
administrator 227, 238
HA 110
LDAP 238
log messages 603
servers 260
users 246
gzip 481, 484
H
half-open 29
threshold 373, 518
halt 571
handshake 42, 80, 233, 296, 310, 313, 336, 553
hang 648, 649
hard disk 575
failure 572, 691
logging to 580
hardening security 56, 79, 98, 221, 223, 226, 237, 311,
312, 313, 317, 320, 323, 325, 333, 445, 464, 639,
675
hardware
failure 105, 266, 572, 573, 574
troubleshooting 674
harvester 532, 539
hash 686
password 690
hasyncd 113
HEAD 524
header
HTTP 230, 235, 260, 275, 412, 444
IP 552
leakage 412
report 621
VLAN 125
health check
server 263, 265, 268
timeout 267
heartbeat
HA 110, 111 interface 76, 111
link 41, 75, 108
hexadecimal 178, 427, 667
encoding 190
hidden fields
input 24, 35, 453 rules 453
high availability (HA) 70, 75, 91, 105, 572
active appliance 44
failover 40
group name 110
heartbeat 40
heartbeat interface 111 interface monitoring 111
main 106
mode 558
pair 44
permission 108
port monitor 111
standby appliance 44, 106
status 558
synchronization 40
VMware 105
HIPAA 28
history
attack events 212
HTTP hits 567
session 39, 361, 364, 368, 438, 443, 456
vulnerability scan 545
hit 34, 501, 508, 567, 631, 632
honeypot 427
Host 383
rewrite 379
host 22, 260, 277, 379, 455
internationalized 711
name 42, 81, 549, 556, 558, 559, 564, 618
illegal 473
protected 260, 262, 517
virtual 260, 262
Host: 249, 255, 275, 339, 379, 381, 383, 390, 444,
467, 473, 510, 517, 637
internationalized 711
HSTS 272, 310, 519
HTML 712 element 712
Fortinet 724 FortiWeb 5.2 Patch 2 Administration Guide
HTTP 66, 124, 125, 128, 265, 267
1.0 517
1.1 260, 517, 524
administrative access 700
authentication 70, 234, 248
CONNECT 149
content routing 268, 515
GET 208, 260, 267, 538
header 235, 260, 412
parser 464, 578, 645
periodically blocked 345, 361, 364, 368, 371, 408,
422, 431, 440, 448, 456, 466, 478, 639
pipelining 18, 524
port number 57
POST 33, 194, 416, 464, 475, 540
XML 498, 506
protocol 36
PUT 205, 475
request 488
flood 365
routing 275
session 34, 41, 160, 193, 438, 496, 497, 523, 577,
715
attack 386
timeout 267
HttpOnly 454
HTTPS 66, 80, 123, 125, 127, 158, 294, 297, 301, 304,
429, 518
administrative access 701
port number 57
request 488
routing 275
session 37, 42
timeout 267
httpsd 138, 139
hyperlink, rewrite 390
hypertext markup language (HTML) 178
entity 427
hypervisor 105, 571
I
i18n 711
IBM
Lotus Domino 13, 182, 221, 238
WebSphere 491
ICMP 124, 128, 267, 618, 675, 677, 699, 700
ECHO_REQUEST 124, 128, 265, 267, 585, 676
ECHO_RESPONSE 675 type 0 124, 128, 267, 675
type 8 124, 128, 267, 676, 681
ID
70007 353
packet 666
session 37, 38, 39
theft 13 identity theft 13
idle 57
IEEE
802.1d 132, 716
802.1q 125, 127, 716
802.3ad 129
Fortinet 725 ignore
action 521 blocking 521
IIS 13, 181, 552
import
certificate 306
CRL 336
infinite loop 648, 649
information disclosure 31, 405, 420, 567, 654
initialization vector (IV) 553
input 160, 212, 449, 453
hidden 24, 35, 444, 453
method 714
rule 444 tag 24, 231, 444, 453
installing 20, 65
FortiWeb-VM 14
interface
administrative access 123, 127
configuring 119
monitoring, HA 111
international
domain name 711
international domain name (IDN) 713
Internet Explorer 317, 325
Internet service provider (ISP) 139
dual 106
interval
ARP 114
HA heartbeat 110
health check 268
monitoring 529
inter-VLAN routing 126, 127
Invalid IP Address 133
IP
address 81, 82, 123, 125, 131, 141
blocked 639
for configuring FortiWeb 119
FortiWeb 119
virtual 685
based forwarding 72
blacklist 353, 354, 639
forwarding 675
header 588
invalid 133
list policy 353
trusted 353, 354
version
4 123
6 26, 123
virtual 72
iPhone 233, 311
IPSec 635
IPv4 123, 711
IPv6 26, 123
ISO 8859-1 713
Issuer 334
J
Japan Credit Bureau (JCB) 177
FortiWeb 5.2 Patch 2 Administration Guide
Japanese 58
Java server pages (JSP) 165, 194
adjusting auto-learning for 163
JavaScript 36, 426, 453, 482, 554, 564, 712
blocking automated tools 360, 367
JBoss 13
jitter 131, 677
Joomla 13, 30, 428
JSESSIONID 37, 165, 505
JSPSESSIONID 232
K
keep-alive 524
key
cryptographic 553
exchange 70, 210, 296, 686
pair 305
private 217, 218, 296, 298, 306, 310, 311, 312,
317, 320, 323, 338
product activation 178
public 312, 313
SSH 83
SSL/TLS 553
type, certificate 303
usage 335
Key Usage: 335
keyword 605
L
LAN 553, 554
virtual 125
language 58, 713, 714
web UI 58
__LASTFOCUS 488
latency 73, 74, 75, 108, 115, 252, 264, 677, 681
Layer
1 138, 139, 667
2 73, 108, 111, 126, 129, 130, 132, 138, 139, 656
multicast 40, 76, 700, 701
3 126, 129, 275, 356, 677
4 129, 138, 139, 275, 356, 488
DoS protection 356
6 274
routing 275
7 295, 356, 372, 488
lazy 707
LDAP
administrator group 238
authentication 699
bind 240 password 240
query 221
LDAPS 239, 241, 294, 297, 700
LED
power 64
license 80, 147
trial 105
validation 143
limit
content length 467
rate 356, 413
line feed 705
link 106, 107, 108
aggregation 129
checker 413
failure 108, 111
layer 130, 667
monitor 111
pair 550
redundant 120
speed 129, 570
status 570, 675
Linux 30, 679, 684
load
and vulnerability scans 534
balancer 281, 350, 361, 364, 407, 588, 642
built-in 66, 71, 159, 515
algorithm 268, 515
weight 268
external 66, 115
FortiADC 66, 115
CPU 566, 617, 648, 687 level 687
page 636
process 687
RAM 648
server farm 516
traffic 688
load balancing
algorithm 268 weight 268
local
console access 56, 564
domain name 140, 141, 549
file inclusion (LFI) 30, 410
hard drive 575
logs 587
locale 714
Location: 24, 25, 383, 390, 453
Fortinet 726 FortiWeb 5.2 Patch 2 Administration Guide
log 572, 573
aggregation 582, 606
attack 341, 346, 351, 355, 362, 365, 369, 371, 376,
409, 422, 431, 436, 441, 449, 457, 460, 467,
478, 577
attacks 200, 345, 361, 364, 368, 371, 407, 421,
430, 440, 448, 456, 466, 478, 521
cleared 662
column view 596
configure 588
details 592, 593
download 600
event 578
filter 598, 599
clear 600
formatted view 596
gap 42
level 574
mount point 691
packet contents 572, 593
PDF 606
raw view 598
reports 619
rotate 581
settings 575, 579
severity 341, 346, 351, 355, 362, 365, 369, 371,
376, 409, 422, 431, 436, 441, 449, 457, 460,
467, 478
standby appliance 107
Syslog 581
table 592
timestamp 99
to memory 581
to the hard disk 580
traffic 577
types 573, 575
log_access 606
login 36, 81, 235, 237, 239, 244, 246, 624, 688
administrator 222, 237
failed 252, 257
page 231
preference 445
prompt 83
script 325
successful 252, 257
timeout 643
user 230, 252, 257
logo 621, 622 delete 622
logout 36, 232
look-ahead 650, 707
loop
infinite 501
Layer 2 130, 132
network 677
redirect 501
loopback 179
lost password 228, 689
Lotus 13
low encryption (LENC) 80
low orbit ion cannon (LOIC) 33
Lulzsec 31
Lync 254
M
Mac OS X 679, 684
Magento 39
mailto 179
main 106, 112
maintainer 690
maintenance 105
malformed request 470
management information block (MIB) 612
support 618
management protocols 643
manager
SNMP 612, 614, 616, 618
man-in-the-middle (MITM) 28, 295, 297, 313, 553
markup 178
mask
sensitive data 584
subnet 127, 131
master 106, 112
Master Card 177
maximum
file size 482
transmission unit (MTU) 125
values 702
MD5 296, 297, 687
media access control (MAC) address 122, 132
conflict 676
virtual 41, 106, 110, 114, 122
memberOf 241
memory
leak 538
log to 581
size 464
test 694
usage 566, 579, 617, 687
menus 60
message authentication checksum (MAC) 313
messages
dashboard 568
error 59, 153, 500
log 252, 257, 336, 343, 348, 378, 409, 438, 443,
451, 498, 499, 506, 517, 587
log types 573
SNMP 612
Metasploit 646
Fortinet 727 FortiWeb 5.2 Patch 2 Administration Guide
Microsoft
activation key 178
Active Directory 221, 238, 241, 245, 253, 323, 325
Excel 602
Exchange Server 463
2003 460
2008 165
2010 13
IIS 13, 181, 412, 552
Internet Explorer 50, 80, 233, 317, 325, 335
Lync 254
Outlook Web App (OWA) 13, 161, 163, 165, 166
Outlook Web Application (OWA) 254
OWA 401
SharePoint 13, 254
Threat Management Gateway 254
Windows 245, 428
7 325
Word 543
MIME 384, 482, 543, 629
minimum cost path 132
mirror
hard disks 572
port 74
MKCALENDAR 467
mode
monitor 521
offline protection 75, 487
operation 68, 102
reverse proxy 71, 126
single administrator 56
switching 214
transparent 73
transparent inspection 73, 487
true transparent proxy 73, 487, 550
vulnerability scan 538
monitor
cookies 212
data analytics 631, 632
events and attacks 555
for defacement 526, 528
HTTP traffic 567
interval 529
mode 521
ports 111
using SNMP 612
Mozilla 428
Firefox 50, 80, 310, 428, 553, 686
MSN 186
mtab 692
multicast 40, 76, 108, 111, 129, 700, 701
multiplexing 67
mutual authentication 310
MySQL 231, 526
N
name
community 615
domain 549 host 549
National Insurance Number (NINO) 178
negative security model 157
negotiation 553, 686
nested
encoding 552
quantifiers 650
netmask 119
administrator account 224
network
address translation (NAT) 66, 120, 281, 285, 354,
362, 365, 378, 488, 534, 635
64 26
and attack origin 588
and period block 361
destination 150
full 71
source 66, 74, 281, 284, 350, 553
interface 80, 82, 119, 125, 131, 138
layer 138, 139, 356, 676
loop 130, 677
mask 119, 125, 127, 131
private 285
settings 119
time protocol (NTP) 99
topology 14, 66, 70, 73, 75, 105
new line 705
newcli 138, 139
next-hop router 135, 137
nginx 13, 181
NIC teaming 120
no-cache/no-store/private 404
notification 529, 608
defacement 526
Novell
eDirectory 238, 241
Novus 177
NSS 553
NT LAN Manager (NTLM) 245
users 246
null 473 characters 467, 473
modem 82
route 137
O
object identifier (OID) 618
offline protection mode 75, 487, 559
switching from 214
offline protection profile 502
offloading 300
compression 481
SSL/TLS 294, 488, 518
vulnerability scans 533, 640
onClick() 712
one 72
one-arm 72, 75, 289
one-arm topology 72
onError() 426
online certificate status protocol (OCSP) 334, 335,
Fortinet 728 FortiWeb 5.2 Patch 2 Administration Guide
337
open system interconnections (OSI) model 356
OpenLDAP 238
OpenOffice 543
OpenSSL 313
operating system (OS) 85, 87
operation mode 66, 68, 70, 102, 558, 559
supported features 69
switching 102
Oracle 526
order of execution 21, 196, 408
outbreak 147
Outlook Web App (OWA) 13, 161, 166, 254
out-of-band 74, 502
OWA 401
OWASP 13, 405
P
packet 593
capture 656, 666
log 572
loss 530, 664, 677
payload 211, 578, 593
received 570
sensitive information 583
sent 570
pad 646
padding oracle 429
page
access 433
requests 567
parameter 160
separator 161
validation 444, 451
value 164
parity 83
parser 645
HTTP 464, 578
XML 498
partition 88, 93, 96, 617, 692, 696
Pass 196, 202, 408
password 80, 81, 82, 83, 84, 98
admin, changing 228, 689
administrator 15, 223
anti-defacement 529
authentication
rule 249
backup 312, 317, 320, 323, 642
encryption 218
brute force 28
complexity 232
encrypting backups 216
encrypting logs 602
end-user 237
enforcing complexity 232
forgotten 228, 689
FTP 217
guess 28
LDAP bind 240
length 690
Level 2 445
lost 55, 225
obscuring 583
predefined data type 178
re-enter 236
reset 55, 228, 689
SMTP 610
strength 59, 98, 178, 223, 237, 311, 643
enforcing 445
strong 59
unencrypted 236
vulnerability scan 539, 540
weak 178
web application 540
with certificate 307
patch 533, 640
payload 463, 578, 593
PCI DSS 28, 29, 98, 223
compliance 234, 414, 533, 626
contraindications 687
PDF
auto-learning report 195
log 606
log-based report 629
PEM 307
penetration test 212
perfect forward secrecy (PFS) 686
performance 20, 21, 42, 180, 188, 189, 212, 349, 350,
Fortinet 729 FortiWeb 5.2 Patch 2 Administration Guide
353, 489, 639, 647, 671, 675
alert email 611
anti-defacement 529, 530, 655
antivirus 148
ARP broadcast 657
authentication 234, 252
auto-learning 160, 189, 190, 208
cache 17, 399, 401
compression 13, 481, 482, 552
data analytics 633
deployment 212
DNS query 140, 264
during a DoS attack 361, 364, 368, 371, 574
during downtime 266
factors in configuration 702
HA 41, 42, 115, 657
header limits 474
HTTPS 518
LACP 130, 131
link aggregation 129
logging 574, 577, 582
network 125, 130, 131, 132
on dashboard 555
packet payload retention 578
padding oracle 429
policies 509
rate limiting 552
redirecting 387
regular expressions 649
reports 619
rewriting 552
scheduling 628
server information disclosure erasing 413, 425
signatures 199, 654
SSL/TLS 13, 294
STP 132
suspicious URL blocking 186
tuning 647
vRAM 703
vulnerability scan 533, 534, 640
period block 200, 345, 361, 364, 368, 371, 407, 408,
421, 422, 430, 431, 440, 448, 456, 466, 478, 639
permission
access 225, 673
account 221, 226
user 232
full 98
HA 108
network 117
router 136, 675
server policy 510
user 227, 236, 238, 243, 246
vulnerability scan 536
web profile 494, 503
permissions 52, 55
persistence
session 278
persistent
server sessions 36
trigger 579
session
HTTP 34
session data 453
personal certificate 233, 334
personally identifiable information 419
phishing 181
phone number 178, 179
PHP 231, 526
PHPSESSIONID 505
physical
layer 138, 139, 676
server 157, 159, 263, 264
topology 66, 70, 73, 75
ping 123, 124, 125, 127, 128, 137, 139, 265, 663, 675,
676, 677, 678, 681, 699, 700
flood 124, 128
timeout 267
pipelining 18, 524
PKCS #12 306
planning 14
policy
allow method 459
chain 262
DoS protection 373
email 608
execution order 21
file decompression 485
FortiAnalyzer 585
HTTP content routing 275
IP list 353
parameter validation 451
server, disable 524
sessions 556
Syslog 584
trigger 341, 346, 351, 355, 362, 365, 369, 371, 376,
409, 422, 431, 436, 441, 449, 457, 461, 467,
479, 587
upload restrictions 476
URL access 339
URL rewriting 379
violation 488
vulnerability scan 542
widget 567, 570
port 72
6056 40
6065 40
channel 129
forwarding 72
monitor, HA 111
network 119
number 40, 143, 158, 159, 518, 616, 666, 699
SNMP 616
SPAN 74
TCP/UDP 699
troubleshooting 685
UDP 124, 128, 681
port1 80, 82, 119
Fortinet 730 FortiWeb 5.2 Patch 2 Administration Guide
port2 119
port3 119, 550 port4 119, 550 port5 550 port6 550 port7 550 port8 550
POST 33, 194, 453, 464, 475, 498, 506, 540
power-on self-test 690
postal code 177
Canadian 177
Quebec 178
Sweden 179
PostgreSQL 231, 526
postnummer 179
power
indicator 64
interruption 550 loss 550
off 63, 571
on 64, 693
supply unit (PSU) 64
power supply unit (PSU) 550
PPPoE 350
predefined
data type 652
suspicious URL 181
primary
appliance 106, 112
heartbeat interface 111
priority
HA 109
URL access 347
private
key 217, 218, 296, 310, 311, 312, 317, 320, 323,
338
network 285
process
ID 687
processing
flow 21
product registration 65
profile
auto-generated 205
inline protection 492
offline protection 502
report 619
prompt 564
PROPFIND 460, 463
protected host 260, 262
protocol 643, 666
proxy 284
anonymous 635
FortiGuard 149
reverse 69
SSL 295
transparent 69
true transparent 73
web 143, 145
Proxy-Authorization: 404
PSH 36
public key infrastructure (PKI) 233, 310, 520
purpose 335
PUT 205, 475
Q
query
anonymous 240
authentication 221, 252 cache 252
DNS 139, 699
filter 240
LDAP 234, 238, 699
LDAPS 700
NTLM 234, 245, 700
OCSP 337
RADIUS 225, 234, 242, 700
report 625
SNMP 124, 128, 612, 613, 616, 618, 700
timeout, authentication 238, 243
R
RADIUS 700
Attribute 225
Attribute 31 245
radius-user 243
RAID 43, 571, 572
RAM usage
and regular expressions 649
random access memory (RAM) 581
Range 469, 474
rapid spanning tree protocol (RTSP) 132
rate limit 39, 339, 356, 413
vulnerability scan 534, 539
raw view, logs 598
RC2 80
RC4 80, 297, 553
reachable 135, 664
read-only 52, 692
real browser enforcement 360, 367
realm 235, 236, 249, 251
reboot 85, 86, 92, 220, 550, 571, 575, 662
recursion 648, 649
recursive payload 498
recursive URL encoding 552
redirect 379, 501, 537
attack 200, 407, 422, 440, 448, 456
example 386
rewrite 379
redundancy 105, 111
Referer 379, 382, 385
rewrite 379
Referer: 24, 25, 383
registering
with Fortinet Technical Support 65
Fortinet 731 FortiWeb 5.2 Patch 2 Administration Guide
regular expression 164, 175, 255, 421, 433, 447
allow method 463
brute force 377
data type 180
encoding 713
GB2312 encoding 58
packets 578
page access 401, 403, 418, 437
parameter 450
start page 442
tuning 211
URL access 342
URL rewrite 383
validator 211
re-imaging 88, 696
relay 609
release IP block 639
reliability 108
remote file inclusion (RFI) 31, 405, 410
rename 63
renegotiation 297, 553
report
attacks 197
auto-learn 191, 200
download 630
empty 572
format 625
format, scans 543
HTML reports 629
logs 619
MS Word format 629
on demand 628 output 628
PDF format 629
profile, logs 621
query 625
schedule 628
scope, logs 622 time span, logs 622
view 630
vulnerability scan 533, 545
request
HTTP 38, 488
HTTPS 38, 488
limits 359
timeout 250
reset 74
CLI Console widget preferences 565
configuration 571, 661, 695
connection 196, 200, 340, 345, 361, 364, 368, 371,
407, 412, 421, 430, 440, 448, 456, 466, 478
password 55, 225, 228, 689
resolution 50
restart 571
restore
anti-defacement 528
CLI command 90, 218
configuration 219
defacement 530
defacement backup 531
firmware 696
FTP backup 219
retransmission time-out (RTO) 33
retry health check 268
reverse proxy mode 71, 126, 559
reverting web site 531
revoke certificate 333, 334
rewrite
body 379
example 393
Host 379 redirect 379
Referer 379
URL 379
rewriting 70
RFC
1213 618
1918 633
2246 296, 429
2548 18, 225, 245
2616 149, 385, 467
2617 234
2665 618
2965 35, 230
3490 713
4918 460, 463
5246 553
5280 233, 310
6797 272, 310, 519
792 124, 128, 267
risk 224
RJ-45 80
RJ-45-to-DB-9 82
roaming profile 325
robot
control 355, 413 group 413
role 92
administrator 226
HA 92
role-based access control (RBAC) 221, 226, 230
root 55
account 226
administrator account 98
ADOM 48
CA 274, 297, 306, 313, 520
directory 94
rootkit 181
Fortinet 732 FortiWeb 5.2 Patch 2 Administration Guide
route
asymmetric 676
content 268
HTTP 274
Layer 6 274
path metrics 75
static 103, 104, 135
table 136, 138, 139, 676, 684
router 72, 103, 115, 119, 138
gateway 137
hop 664
next hop 135, 137
RPC 13, 482, 496
content length 467
RSA 306, 312
RST 74, 75, 517
RTF
bookmarks 178
report 629
rule violation 488
Rx 570
S
sandboxing 428
scan
AMF3 requests 497
order of execution 21
using certificates 488
vulnerabilities 535
scheduling 99
reports 628
updates 149, 150
vulnerability scan 535
Schema 712
poisoning 498
XML 498
schema, LDAP 235, 238, 241
scout 181
SCP 699
search
attack log 603
engine 413
secondary
appliance 106, 112
heartbeat interface 111
Secure Shell (SSH) 56, 78, 123, 124, 125, 127, 128,
564, 635
administrative access 700
and anti-defacement 528, 699
forwarded to servers 72
key 83
version 82
security
auditor 221
certificate 80
idle timeout 57
key size 303
passwords 98, 223, 237
settings, admin 59
TLS 297
trusted host 224
tuning 641
segregation of duties 230
self-signed 81
sensitive information 405
logs 583
sequence of scans 21
serial
number 690
serial communications (COM) port 82
serial number 44, 556, 558, 559, 618
certificate 298, 301, 308, 337
server
down 569 farm 159, 268, 488, 569
health check 263, 265, 268, 647
physical 263, 264
protected 260
status 263, 265, 268, 569
virtual 288
Server: 24, 412, 424
service level agreement (SLA) 105
services 290
custom 291
HTTP 158, 291
HTTPS 159, 291 predefined 291
servlet 181, 232
Fortinet 733 FortiWeb 5.2 Patch 2 Administration Guide
session 34, 160, 193, 523, 556
administrator 59
attacks during 197
client-side 515
continuity in server farms 281
cookie 35, 37, 232, 356, 374, 488
old 38
count 570
data 200, 340, 345, 361, 364, 368, 371, 408, 422,
431, 440, 448, 453, 456, 466, 478
decrypted 296
expiration 577
hijacking 386
history 39, 40, 361, 364, 368, 438, 443, 456
HTTP 41, 438, 496, 715
maximum 517
HTTPS 37
ID 38, 70, 193, 386, 497, 505
cookie 505
initiator 438, 637
IP 68, 131
management 70, 356, 496
maximum number 703
persistence 278
persistent server 517, 578
server-side 232, 515
SSL/TLS 42
statistics 493, 502
stolen 434
synchronization 41
table 40
timeout 38, 232, 356, 496, 505, 520
Set-Cookie 38
Set-Cookie: 404
severity
level 341, 346, 351, 355, 362, 365, 369, 371, 376,
409, 422, 431, 436, 441, 449, 457, 460, 467,
478, 572, 624
log levels 574
SFTP
backup via 217
forwarded to servers 72
SHA-1 82, 297
shared Internet connection 552
SharePoint 254
shell code 444
Shift-JIS 713
shopping cart 34
show 226
shut down 63, 64, 571
sidejacking 37
signature 313
attack 160, 405, 419
CA 297, 314, 324, 333
custom 420
data leak 419
digital 335
ID 409
set 211
virus 148
Fortinet 734
signing chain 274, 306, 520
simple certificate enrollment protocol (SCEP) 303,
309, 337
simple mail transport protocol (SMTP) 699
AUTH 609 relay 609
simple network management protocol (SNMP) 124,
125, 128, 612, 614
agent 612, 613 contact information 613
manager 616, 618
MIB 618
OID 618
query 616, 700
system name 549
trap 699
single sign-on (SSO) 232, 253
slave 106
slowloris 34
SMTPS 294, 297
sniffer 666
social engineering 181
Social Insurance Number (SIN) 177
Social Security Number (SSN) 178, 179
socket exhaustion 29, 34, 372
sort code 179
source
code disclosure 538
IP address
client’s original 66, 281, 588
NAT (SNAT) 66, 74, 281, 284, 350, 588
network address translation (SNAT) 284
SPAN port 74, 75
spanning tree protocol (STP) 132
SPDY 37
special characters 549, 713
spider 413
split
brain 92
horizon 677
SQL
injection 32, 150, 405, 410, 497, 506, 538, 567
blind 410
statements 178
sshd 138, 139
SSL 70, 99, 239, 272, 297, 300
accelerator 13, 294
certificate 519
handshake 313
hardware accelerated 518
inspection 269
offload 294, 488, 518
on the web servers 103, 104
origin 488
renegotiation 553
terminator 488
version 70, 81, 313, 518
2.0 296, 429
3.0 296, 429
ssl_error_no_cypher_overlap 80, 686
FortiWeb 5.2 Patch 2 Administration Guide
staging 533
standard time 100
standby 44, 75, 106, 112
start page 438
STARTTLS 239, 241, 294
startup script 325
state
name 179
tracking 212
transition 35, 37
stateless 34
static
route 103, 104, 135
URL 160, 404
status
FortiWeb 549, 555
HA 559
server 263, 265, 268
stolen session 434
storage
area network (SAN) 571 repository 571
strength
bit 82, 297, 313
encryption 687
password 98, 178, 223, 237
strict transport security 272, 310, 519
striping 572
Subject 301, 316, 334
subject information, certificate 304
submit CSR 305
subnet 123, 125, 127, 131
Subversion 181, 459
Swedish personnummer 179
switch 40, 75, 105, 108
operation mode 65
standby 106
VLAN 125
SYN 29, 36, 267, 373
cookie 70, 518
flood 34, 372, 517
synchronization
configuration 41, 57, 115, 116
HA 42, 75, 700, 701
interval 100
non-HA 57
non-HA cluster 115, 116, 700, 701
NTP 699
partial 117
port 40 traffic 40
type 117
syntax
error 470
Syslog 587, 700
config 581
log storage 575
policy 584
verify logging 585
Fortinet 735 system
resource usage 556
status 87, 549, 555, 556
time 99, 556, 560
T
tag 449, 712
VLAN 125
tampering
cookie 497
hidden input 453
TCP 265, 618, 699, 700
ACK 36, 267, 372
connection 36, 488
limit 362
timeout 520
flood 369
port number 518
protocol 36
PSH 36
retransmission 129, 131
RST 74, 75, 196, 200, 340, 345, 361, 364, 368,
371, 407, 412, 421, 430, 440, 448, 456, 466,
478, 517
RTO 33, 129
SYN 29, 34, 36, 267, 373, 517
flood 34, 372
SYN ACK 372
timeout 267
tcpdump 666
Telnet 56, 78, 124, 125, 128, 564, 644, 700
terminal 78
server 696
TFTP 85, 94, 699
Thawte 313, 314
theft
credit card 29
threshold
half-open 373, 518
throughput 567
time 99, 139, 177, 556, 560
to live (TTL) 666, 681
zone 146, 147
timeout
authentication query 238, 243
cache 252
connection 251
cache 250
health check 265, 267
idle 57
persistent 520 session 36, 38, 232, 496, 505, 520
vulnerability scan 539
web UI 57
tips 211
TLD 711
FortiWeb 5.2 Patch 2 Administration Guide
TLS 272
acceleration 13
handshake 313
renegotiation 553
version 81, 313, 518
1.0 296, 429
token 709
top 138, 139, 687
topology 14, 66, 70, 73, 75
HA 75 offline 75
one-arm 72
reverse proxy 71
transparent 73
Tor 32, 350
TRACE 459
trace connection state 666
traceroute 124, 128, 137, 139, 585, 663, 675, 676,
677, 681, 699, 700
tracert 137, 139, 676, 681, 683
traffic
controller (TC) 275
flow troubleshooting 688
log 577
volume 321, 501, 508, 567, 575, 628
vulnerability scan 534
Tranfer-Encoding: 379
transactions 702
accelerated by pipelining 524
Transfer-Encoding: 404
transparent
inspection mode 73, 487, 559
mode 73 proxy 73
transport
layer 138, 139, 356, 676
layer security (TLS) 297
trap 339, 435, 612, 613, 616, 618, 699
trial license 80, 105
trigger
alerts 572
log settings 579
policy 341, 346, 351, 355, 362, 365, 369, 371, 376,
409, 422, 431, 436, 441, 449, 457, 461, 467,
479, 587
tripwire 428
trojan 411, 479
troubleshooting 530, 663
auto-learning 161, 190
bootup 693
compression 482
connectivity 137, 138
debug packet flow 686
HA 112
HA failover due to reboot 114
hardware 674
load balancing with server-side sessions 515
resources 687
routing 137
routing table 684
URL interpreters 204
true transparent proxy mode 487, 550, 559
True-Client-IP 281, 287
trunk 127
LACP 130 link aggregation 130
trust
store 323
trusted
certificates 81, 314
browser 306, 314, 317, 325
FortiWeb 297
host 56, 224, 642, 689
IP 354
tunnel 635
update 149
turn on 64
Twiki 37
TWIKISID 37
Twitter 658
Tx 570
type 0, ICMP 124, 128, 267, 675
type 8, ICMP 124, 128, 267, 676, 681
type of service (tos) bits 666
U
UDP 40, 124, 128, 618, 681, 699, 701
UK vehicle registration 178
unauthorized 147
Unicode 552, 650
uniform resource identifier (URI) 179
UNIX 78
up
link 570
server 569
upgrade
firmware 87
FortiGuard services 150, 153
release schedule 149
Fortinet 736 FortiWeb 5.2 Patch 2 Administration Guide
upload 307, 475
certificate 299, 300
certificate, local 306
certificate, remote 337
CRL 336
FortiWeb configuration 219
limit 476
logo 621, 622
restrictions 476
uptime 44, 92, 105, 109, 212, 556, 560, 569
URL 80, 81, 124, 220
access 339
dynamic 160, 161, 193
encoding 190, 552
interpreter 161
replacer 161, 190, 193, 204
rewriting 70, 379
static 160
suspicious 181
usage
CPU 566, 617, 618, 687
and regular expressions 648
disk 566, 617, 691
RAM 566, 617, 687
and regular expressions 649
US-ASCII 549, 667, 668, 713, 714
user
authentication 230
supporting modes 74, 75
groups 246
name 222, 237
FTP 218
LDAP 239
NTLM 246
SMTP 609
validation 445
vulnerability scan 539
password 237
User-Agent: 24, 413
UTF-8 58, 711
__utma 488
V
validator, regular expression 211
Vary: 404
VBScript 178
VeriSign 313, 314
violation 488
Fortinet 737 virtual
domain (VDOM) 53
FortiWeb appliance (FortiWeb-VM) 132
host 259, 260, 262, 428, 677
IP (VIP) 72, 260, 685
LAN (VLAN) 73, 119, 120, 121, 125
deleted 559
ID 125, 127
tag 125
trunk 127
MAC address 41, 106, 110, 114, 122
MAC address (VMAC) 106
network interface (vNIC) 119, 132, 134
private network (VPN) 635
server 157, 262, 288, 487, 516
and ARP 685
switch (vSwitch) 132
virus 411
Visa 177
visit 34, 231, 637
vMotion 105
VPN 350
vulnerability scan
history 545
mode 538
policy 542
preparation 534
profile 536
rate limit 539
report 533, 545
report format 543
schedule 535
start, stop 544
timeout 539
workflow 533
V-zone 69, 120, 487, 516
and fail-to-wire 550
topology 73
W
W3C
Schema 498, 712
XML
validation 498, 506
Web 2.0 498, 506
web application firewall (WAF) 13
web browser 50, 78, 80, 124, 220
compatible 50
warnings 81
web crawler 413, 541
web protection profile generating from auto-learning data generate
profile 195
web scraping 187
web user interface (web UI) 80
language 58
navigation 60
requirements 50
timeout 57
URL 50
FortiWeb 5.2 Patch 2 Administration Guide
WebDAV 459, 460, 463
WebSphere 491
wget 360, 367
white list 489
IP 354
white space 706
widget 60, 555, 557
WiFi 553
wiki 37
code 178
wild card 599
Windows 245
WordPress 13, 379
adapting auto-learning to 169
WWW-Authenticate: 230, 231, 235, 253
X
X 67
X.509 306, 311
version 3 300
X509 Error 52 - Get client certificate failed 336
X509 Error 53 - Protocol error 336
X-AspNetMvc-Version: 424
X-AspNet-Version: 424
X-Client-Cert: 273, 520
X-Forwarded-For 606
X-Forwarded-For: 24, 67, 70, 71, 281, 284, 287, 350,
496, 588, 624, 642
X-Forwarded-Proto: 285
XML 463
AJAX 498, 506 element 498, 506, 712
protection 498, 506
scanning 405
validate 498, 506
X-Powered-By: 24, 424
X-Real-IP: 67, 281, 284, 287, 496, 642
XSS 31, 150, 405, 409, 497, 506, 538
Y
Yahoo! 186
Z
zero-day 419, 444
Zeus 33
ZIP code 177
zombie 143
Fortinet 738 FortiWeb 5.2 Patch 2 Administration Guide
