FortiWeb

Course Description

In this 2-day class, you will learn to deploy, configure, and troubleshoot Fortinet's web application firewall: FortiWeb.

Instructors explain key concepts of web application security, and lead lab exercises where you will explore protection and performance features. Through traffic and attack simulations with real web applications in the lab, you will learn how to distribute load from virtual servers to real servers while enforcing logical parameters, inspecting flow, and securing HTTP session cookies.

Formats

  • Instructor-led classroom
  • Instructor-led online*
  • Self-paced online

* Private class only. Please contact your Fortinet Sales Representative.

Product Versions

FortiWeb 5.3

Agenda

  1. WAF Concepts
  2. Basic Setup
  3. Integrating External SIEM
  4. Integrating Front-End SNAT & Load Balancers
  5. DoS & Defacement
  6. Signatures, Sanitization, & Auto-learning
  7. SSL & TLS
  8. Authentication & Access Control
  9. PCI DSS 3.0 Compliance
  10. Caching & Compression
  11. Rewriting & Redirects
  12. Troubleshooting

Objectives

After completing this course, you will be able to:

  • Understand application-layer threats
  • Fight defacement & DoS
  • Prevent zero-day attacks without disrupting live traffic
  • Give apps ex post facto compliance with OWASP Top 10 for 2013 & PCI DSS 3.0
  • Discover vulnerabilities in your servers & hosted web apps for tailored, efficient protection
  • Configure FortiGate together with FortiWeb for stronger HTTP and XML application security
  • Prevent accidental scan circumvention, yet allow FTP, and SSH
  • Configure blocking & reporting for an external FortiADC/FortiGate & FortiAnalyze
  • Choose the right operating mode
  • Balance load among a server pool
  • Enforce SSL/TLS, authentication, & sophisticated access control for “naked” apps
  • Train FortiWeb to defend your specific apps.
  • Blacklist suspected hackers, DDoS participants, and content scrapers
  • Troubleshoot traffic flow, including for FTP/SSH.
  • Diagnose false positives & customize signatures
  • Optimize performance

Who Should Attend

Anyone who is responsible for day-to-day management of a FortiWeb appliance.

Prerequisites

  • Knowledge of OSI layers & HTTP protocol
  • Basic experience with HTML, JavaScript, and a server-side dynamic page language such as PHP
  • Basic experience with FortiGate port forwarding

System Requirements

If you take the online version of this class, you must have a computer with:

  • High-speed Internet connection
  • Up-to-date web browser
  • PDF viewer
  • Speakers / headphones
  • Either:
    • HTML 5 support or
    • Up-to-date Java runtime environment (JRE) with Java plugin enabled in your web browser

Wired Ethernet connection (not Wi-Fi) recommended. Firewalls including Windows Firewall or FortiClient must allow connections with the online labs.

Certification

This prepares you for the FortiWeb Specialist Exam. This course is part of preparation for the NSE 6 certification exam.

How to Enroll

You can follow the links below to the Fortinet Learning Center catalog entries. You must be logged into the FLC to access these links: