FortiWeb

Course Description

In this three-day class, candidates will learn how to deploy, configure, and troubleshoot Fortinet's web application firewall: FortiWeb.

Instructors will explain key concepts of web application security, and lead lab exercises in which candidates will explore protection and performance features. In the lab, candidates will experience traffic and attack simulations that use real web applications.  Candidates will work with those simulations to learn how to distribute load from virtual servers to real servers, while enforcing logical parameters, inspecting flow, and securing HTTP session cookies.

Formats

  • Instructor-led classroom
  • Instructor-led online*
  • Self-paced online

* Private class only. Please contact their Fortinet Sales Representative for more information.

Product Versions

FortiWeb 5.6.0

Agenda

  1. Introduction
  2. Basic Setup
  3. Integrating External SIEM
  4. Integrating Front-End SNAT & Load Balancers
  5. DoS and Defacement
  6. Signatures, Sanitization, and Auto-Learning
  7. SSL and TLS
  8. Authentication and Access Control
  9. PCI DSS 3.0 Compliance
  10. Caching and Compression
  11. Rewriting and Redirects
  12. Troubleshooting

Objectives

After completing this course, candidates will be able to:

  • Understand application-layer threats
  • Fight defacement & DoS
  • Prevent zero-day attacks without disrupting live traffic
  • Make apps retroactively compliant with OWASP Top 10 for 2013 and PCI DSS 3.0
  • Discover vulnerabilities in their servers & hosted web apps for tailored, efficient protection
  • Configure FortiGate together with FortiWeb for stronger HTTP and XML application security
  • Prevent accidental scan circumvention, while allowing FTP and SSH
  • Configure blocking & reporting for an external FortiADC or FortiGate, and FortiAnalyze
  • Choose the right operating mode
  • Balance load among a pool of servers
  • Enforce SSL/TLS, authentication, & sophisticated access control for naked apps
  • Train FortiWeb to defend their specific apps
  • Blacklist suspected hackers, DDoS participants, and content scrapers
  • Troubleshoot traffic flow, including flow for FTP/SSH
  • Diagnose false positives and customize signatures
  • Optimize performance

Who Should Attend

Networking and security professionals involved in the administration and support of FortiWeb. 

Prerequisites

  • Knowledge of OSI layers and the HTTP protocol
  • Basic experience with HTML, JavaScript, and a server-side dynamic page language such as PHP
  • Basic experience using FortiGate port forwarding

System Requirements

To take this course online, candidates must have the following:

  • High-speed Internet connection
  • Up-to-date web browser
  • PDF viewer
  • Speakers or headphones
  • HTML 5 support

You should use a wired Ethernet connection, not a Wi-Fi connection. Firewalls, including Windows Firewall or FortiClient, must allow connections with the online labs.

Certification

This course prepares candidates for the FortiWeb 5.6.0 Specialist Exam.

This is one of the courses that prepares candidates to take the NSE 6 certification exam.

How to Enroll

Click here and navigate to the NSE 6 section.