Pre-Order Your Fortinet NSE 5 - FortiWeb 8.0 Administrator NSE5_FWB_AD-8.0

A FortiWeb server policy binds the listener, destination pool, and service handling required for traffic flow. The virtual server defines the public-facing listener where client traffic arrives. The server pool defines the real back-end servers or load-balanced pool where FortiWeb forwards accepted traffic. The service or port settings define whether FortiWeb handles HTTP, HTTPS, or another configured service. A WAF profile is important for security inspection, but the question asks for the three components needed to complete the forwarding policy. DNS resolver, URL rewrite, health checks, IPsec tunnels, and static routes may be useful in some deployments, but they are not the required core components of the server policy.

================

The issue is unauthorized access through a mobile API, so the control must enforce API-specific identity and access rules. FortiWeb API protection can validate API structure, methods, paths, and authorization requirements, while client management can help associate requests with legitimate clients or authenticated users. ZTNA profiles and cookie security can help with access and session protection, but they do not replace API-specific authorization controls. Switching reverse-proxy mode to bypass cookie controls makes no sense and could weaken protection. Replacing ZTNA with bot protection addresses a different problem: automation, not API authorization. Logging only records activity after the fact and does not prevent bypass. The correct action is to enable API protection and client management for mobile API traffic.

================

When FortiWeb is deployed behind a load balancer or upstream proxy, it may see only the load balancer IP address as the source for every request. This causes poor client identification and can lead FortiWeb to block many legitimate users as if they are one abusive client. The correct fix is to preserve the original client IP address in an HTTP header, commonly using X-Forwarded-For or a similar trusted client-IP header. FortiWeb can then be configured to read that header for accurate client identification, logging, rate limiting, and IP-based security decisions. Bot detection, signature updates, and HTTPS caching do not solve the core source-IP visibility problem.

================