WAF captures all backend errors

Question

Hello, 
 I'm in the process of converting a linux/apache box that was used as a reverse proxy to UTM 9 WAF, and I've bumped into an issue. 
 I' ve just spend over an hour trying to figure out why a migrated site gave a 403 error page on every request. Finally I found that the site itself (on the real server) generated a 503, with a message saying the database credentials were not correct. 
 Is there a way to configure the WAF to not hide these kind of messages?

ewadie · Answer

Here's what I think happened: 
 The Common Threats filter of your firewall profile blocked the 503 response with a 403 error to prevent information leakage. 
 The "Outbound" category of the Common Threats filter contains rules like (I'm quoting comments from the outbound rules file here): 
 * SQL Errors leakage 
 * IIS Errors leakage 
 Probably one of those rules matched and triggered the 403 block page. 
 You can check reverseproxy.log to see if that's really the case.