NSE5-FWB-AD-8-0: Fortinet NSE 5 - FortiWeb 8.0 Administrator

By Fortinet · Question Mode

QuestionQ15

VerifiedDeployment and configuration

Refer to the exhibit.

Question Image

You deployed FortiWeb behind a FortiGate configured as a reverse proxy that inserts the X-Forwarded-For HTTP header when it forwards HTTP and HTTPS traffic.

FortiWeb uses a custom inline protection profile, and logging is enabled, as shown in the exhibit. You observe that FortiWeb is blocking legitimate users, and every request in the attack logs seems to originate from the FortiGate IP address rather than the original client IP addresses.

Which action should you take to resolve this issue?

Explanation

When an upstream reverse proxy hides the client source address, FortiWeb must use a configured X-Forwarded-For/X-header rule in the inline protection profile to identify the original client. Otherwise, IP-based detection treats all traffic as coming from the proxy address, which can cause legitimate users to be blocked together and logs to show only the FortiGate IP.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!