Profiles
Use WAN optimization profiles to apply WAN optimization techniques to traffic to be optimized. In a WAN optimization profile you can select the protocols to be optimized and for each protocol you can enable SSL offloading (if supported), secure tunneling, byte caching and set the port or port range the protocol uses. You can also enable transparent mode and optionally select an authentication group. You can edit the default WAN optimization profile or create new ones.
To configure a WAN optimization profile go to WAN Opt. & Cache > Profiles and edit a profile or create a new one.
From the CLI you can use the following command to configure a WAN optimization profile to optimize HTTP traffic.
config wanopt profile
edit new-profile
config http
set status enable
end
| Transparent Mode | Servers receiving packets after WAN optimization “see” different source addresses depending on whether or not you select Transparent Mode. For more information, see Profiles. |
| Authentication Group | Select this option and select an authentication group so that the client and server-side FortiGate units must authenticate with each other before starting the WAN optimization tunnel. You must also select an authentication group if you select Secure Tunneling for any protocol. You must add identical authentication groups to both of the FortiGate units that will participate in the WAN optimization tunnel. For more information, see . |
| Protocol | Select CIFS, FTP, HTTP or MAPI to apply protocol optimization for the selected protocols. See Profiles. Select TCP if the WAN optimization tunnel accepts sessions that use more than one protocol or that do not use the CIFS, FTP, HTTP, or MAPI protocol. |
| SSL Offloading | Select to apply SSL offloading for HTTPS or other SSL traffic. You can use SSL offloading to offload SSL encryption and decryption from one or more HTTP servers to the FortiGate unit. If you enable this option, you must configure the security policy to accept SSL‑encrypted traffic. If you enable SSL offloading, you must also use the CLI command config firewall ssl-server to add an SSL server for each HTTP server that you want to offload SSL encryption/decryption for. For more information, see . |
| Secure Tunneling |
The WAN optimization tunnel is encrypted using SSL encryption. You must also add an authentication group to the profile. For more information, see . |
| Byte Caching | Select to apply WAN optimization byte caching to the sessions accepted by this rule. For more information, see “Byte caching”. |
| Port | Enter a single port number or port number range. Only packets whose destination port number matches this port number or port number range will be optimized. |
Processing non-HTTP sessions accepted by a WAN optimization profile with HTTP optimization
From the CLI, you can use the following command to configure how to process non-HTTP sessions when a rule configured to accept and optimize HTTP traffic accepts a non-HTTP session. This can occur if an application sends non-HTTP sessions using an HTTP destination port.
config wanopt profile
edit default
config http
set status enable
set tunnel-non-http {disable | enable}
end
To drop non-HTTP sessions accepted by the rule set tunnel-non-http to disable, or set it to enable to pass non‑HTTP sessions through the tunnel without applying protocol optimization, byte-caching, or web caching. In this case, the FortiGate unit applies TCP protocol optimization to non-HTTP sessions.
Processing unknown HTTP sessions
Unknown HTTP sessions are HTTP sessions that do not comply with HTTP 0.9, 1.0, or 1.1. From the CLI, use the following command to specify how a rule handles such HTTP sessions.
config wanopt profile
edit default
config http
set status enable
set unknown-http-version {best-effort | reject | tunnel}
end
To assume that all HTTP sessions accepted by the rule comply with HTTP 0.9, 1.0, or 1.1, select best-effort. If a session uses a different HTTP version, WAN optimization may not parse it correctly. As a result, the FortiGate unit may stop forwarding the session and the connection may be lost. To reject HTTP sessions that do not use HTTP 0.9, 1.0, or 1.1, select reject.
To pass HTTP sessions that do not use HTTP 0.9, 1.0, or 1.1, but without applying HTTP protocol optimization, byte-caching, or web caching, you can also select tunnel. TCP protocol optimization is applied to these HTTP sessions.