FortiADC Adaptive Learning WAF Demo | Application Security

### Overview In this demonstration, Gerard Garcia, Technical Marketing Engineer at Fortinet, introduces the Adaptive Learning Web Application Firewall (ALWAF) feature on FortiADC. The Adaptive Learning engine analyzes datasets generated from live incoming client and server traffic to continuously learn, evaluate statistics, and provide tailored WAF policy recommendations. These recommendations can be accepted, ignored, or deleted by an administrator. ALWAF complements FortiADC's core capabilities in load balancing, traffic optimization, and acceleration by automating and streamlining application security policy creation.

### Key Topics - **Licensing Requirements**: ALWAF can be evaluated using a 30-day free trial on new FortiADC 7.6.0 deployments, or unlocked in production via a WAF signature license or a bundle license. - **Virtual Server & Decompression Configuration**: Traffic inspection for payload types such as XML and JSON requires HTTP decompression to be configured and bound to the virtual server. - **Adaptive Learning Profiles**: Profiles define parameters including name, sampling rate, false positive threshold, learning duration (set to one minute for testing), actions (deny, alert, block, silent deny, or CTA), and protected URL lists. - **Policy Recommendation Lifecycle**: Reviewing generated analysis data and deciding whether to accept, ignore, or delete recommended policy additions.

### Technical Details Garcia demonstrates configuring a virtual server named `VS_HTTP` bound to a decompression profile named `decompress01` with configured URI and content-type settings, ensuring JSON and XML data streams can be parsed. A WAF profile named `test_al` is bound to the virtual server to monitor incoming traffic.

Using an adaptive learning profile named `adaptive learning fastest` configured with a 1-minute learning window, Garcia executes several demonstrations using curl scripts from the desktop: 1. **XML Detection**: A curl script sends traffic containing `bot_test.html` to `VS_HTTP`. After the 1-minute learning cycle, the analysis engine generates a recommendation to enable XML protection, which is accepted. 2. **JSON Detection**: A subsequent curl request generates traffic statistics and, after one minute, triggers a recommendation to enable JSON protection limits. This recommendation is accepted and reflected under the `test_al` profile. 3. **Bot Detection**: Prior analytics data is cleared using the delete option. Garcia executes a curl script repeatedly in rapid succession. The high request frequency (reaching 4 requests per second) triggers a recommendation to enable bot protection. 4. **Web Attack Signature & Combined Detection**: A curl script simulating an attack is run multiple times. The engine produces dual recommendations: web attack protection and bot detection. Accepting these updates automatically binds attack signature protection, JSON validation, XML validation, and bot protection into the active profile.

### Takeaways FortiADC's Adaptive Learning WAF reduces manual tuning overhead by learning from traffic patterns in real time and providing discrete, actionable security recommendations. Administrators maintain oversight by choosing to accept, ignore, or delete suggested protections for web attacks, bot traffic, XML, and JSON payloads.