Fortinet black logo

Administration Guide

Transparent web proxy forwarding

Transparent web proxy forwarding

In FortiOS, there is an option to enable proxy forwarding for transparent web proxy policies and regular firewall policies for HTTP and HTTPS.

In previous versions of FortiOS, you could forward proxy traffic to another proxy server (proxy chaining) with explicit proxy. Now, you can forward web traffic to the upstream proxy without having to reconfigure your browsers or publish a proxy auto-reconfiguration (PAC) file.

Once configured, the FortiGate forwards traffic generated by a client to the upstream proxy. The upstream proxy then forwards it to the server.

To configure proxy forwarding:
  1. Configure the web proxy forwarding server:
    config web-proxy forward-server
        edit "upStream_proxy_1"
            set ip 172.16.200.20
            set healthcheck enable
            set monitor "http://www.google.ca"
        next
    end
  2. Append the web proxy forwarding server to a firewall policy:
    config firewall policy
        edit 1
            set name "LAN To WAN"
            set srcintf "port10"
            set dstintf "port9"
            set srcaddr "all"
            set dstaddr "all"
            set action accept
            set schedule "always"
            set service "ALL"
            set utm-status enable
            set logtraffic all
            set webproxy-forward-server "upStream_proxy_1"
            set fsso disable
            set av-profile "av"
            set ssl-ssh-profile "deep-custom"
            set nat enable
        next
    end

Selectively forward web requests to a transparent web proxy

Web traffic over HTTP/HTTPS can be forwarded selectively by the FortiGate's transparent web proxy to an upstream web proxy to avoid overwhelming the proxy server. Traffic can be selected by specifying the proxy address, which can be based on a FortiGuard URL category.

Note

The FortiGuard web filter service must be enabled on the downstream FortiGate.

Topology

Forwarding behavior

The forward server will be ignored if the proxy policy matching for a particular session needs the FortiGate to see authentication information inside the HTTP (plain text) message. For example, assume that user authentication is required and a forward server is configured in the transparent web proxy, and the authentication method is an active method (such as basic). When the user or client sends the HTTP request over SSL with authentication information to the FortiGate, the request cannot be forwarded to the upstream proxy. Instead, it will be forwarded directly to the original web server (assuming deep inspection and http-policy-redirect are enabled in the firewall policy).

The FortiGate will close the session before the client request can be forwarded if all of the following conditions are met:

  • The certificate inspection is configured in the firewall policy that has the http-policy-redirect option enabled.
  • A previously authenticated IP-based user record cannot be found by the FortiGate's memory during the SSL handshake.
  • Proxy policy matching needs the FortiGate to see the HTTP request authentication information.

This means that in order to enable user authentication and use webproxy-forward-server in the transparent web proxy policy at the same time, the following best practices should be followed:

  • In the firewall policy that has the http-policy-redirect option enabled, set ssl-ssh-profile to use the deep-inspection profile.
  • Use IP-based authentication rules; otherwise, the webproxy-forward-server setting in the transparent web proxy policy will be ignored.
  • Use a passive authentication method such as FSSO. With FSSO, once the user is authenticated as a domain user by a successful login, the web traffic from the user's client will always be forwarded to the upstream proxy as long as the authenticated user remains unexpired. If the authentication method is an active authentication method (such as basic, digest, NTLM, negotiate, form, and so on), the first session containing authentication information will bypass the forward server, but the following sessions will be connected through the upstream proxy.

Sample configuration

On the downstream FortiGate proxy, there are two category proxy addresses used in two separate transparent web proxy policies as the destination address:

  • In the policy with upstream_proxy_1 as the forward server, the proxy address category_infotech is used to match URLs in the information technology category.

  • In the policy with upstream_proxy_2 as the forward server, the proxy address category_social is used to match URLs in the social media category.

To configure forwarding requests to transparent web proxies:
  1. Configure the proxy forward servers:
    config web-proxy forward-server
        edit "upStream_proxy_1"
            set ip 172.16.200.20
        next
        edit "upStream_proxy_2"
            set ip 172.16.200.46
        next
    end
  2. Configure the web proxy addresses:
    config firewall proxy-address
        edit "category_infotech"
            set type category
            set host "all"
            set category 52
        next
        edit "category_social"
            set type category
            set host "all"
            set category 37
        next
    end
  3. Configure the firewall policy:
    config firewall policy
        edit 1
            set srcintf "port10"
            set dstintf "port9"
            set srcaddr "all"
            set dstaddr "all"
            set action accept
            set schedule "always"
            set service "ALL"
            set utm-status enable
            set inspection-mode proxy
            set http-policy-redirect enable
            set ssl-ssh-profile "deep-inspection"
            set av-profile "av"
            set nat enable
        next
    end
  4. Configure the proxy policies:
    config firewall proxy-policy
        edit 1
            set proxy transparent-web
            set srcintf "port10"
            set dstintf "port9"
            set srcaddr "all"
            set dstaddr "category_infotech"
            set service "webproxy"
            set action accept
            set schedule "always"
            set logtraffic all
            set webproxy-forward-server "upStream_proxy_1"
            set utm-status enable
            set ssl-ssh-profile "deep-inspection"
            set av-profile "av"
        next
        edit 2
            set proxy transparent-web
            set srcintf "port10"
            set dstintf "port9"
            set srcaddr "all"
            set dstaddr "category_social"
            set service "webproxy"
            set action accept
            set schedule "always"
            set logtraffic all
            set webproxy-forward-server "upStream_proxy_2"
            set utm-status enable
            set ssl-ssh-profile "deep-inspection"
            set av-profile "av"
        next
    end

Transparent web proxy forwarding

In FortiOS, there is an option to enable proxy forwarding for transparent web proxy policies and regular firewall policies for HTTP and HTTPS.

In previous versions of FortiOS, you could forward proxy traffic to another proxy server (proxy chaining) with explicit proxy. Now, you can forward web traffic to the upstream proxy without having to reconfigure your browsers or publish a proxy auto-reconfiguration (PAC) file.

Once configured, the FortiGate forwards traffic generated by a client to the upstream proxy. The upstream proxy then forwards it to the server.

To configure proxy forwarding:
  1. Configure the web proxy forwarding server:
    config web-proxy forward-server
        edit "upStream_proxy_1"
            set ip 172.16.200.20
            set healthcheck enable
            set monitor "http://www.google.ca"
        next
    end
  2. Append the web proxy forwarding server to a firewall policy:
    config firewall policy
        edit 1
            set name "LAN To WAN"
            set srcintf "port10"
            set dstintf "port9"
            set srcaddr "all"
            set dstaddr "all"
            set action accept
            set schedule "always"
            set service "ALL"
            set utm-status enable
            set logtraffic all
            set webproxy-forward-server "upStream_proxy_1"
            set fsso disable
            set av-profile "av"
            set ssl-ssh-profile "deep-custom"
            set nat enable
        next
    end

Selectively forward web requests to a transparent web proxy

Web traffic over HTTP/HTTPS can be forwarded selectively by the FortiGate's transparent web proxy to an upstream web proxy to avoid overwhelming the proxy server. Traffic can be selected by specifying the proxy address, which can be based on a FortiGuard URL category.

Note

The FortiGuard web filter service must be enabled on the downstream FortiGate.

Topology

Forwarding behavior

The forward server will be ignored if the proxy policy matching for a particular session needs the FortiGate to see authentication information inside the HTTP (plain text) message. For example, assume that user authentication is required and a forward server is configured in the transparent web proxy, and the authentication method is an active method (such as basic). When the user or client sends the HTTP request over SSL with authentication information to the FortiGate, the request cannot be forwarded to the upstream proxy. Instead, it will be forwarded directly to the original web server (assuming deep inspection and http-policy-redirect are enabled in the firewall policy).

The FortiGate will close the session before the client request can be forwarded if all of the following conditions are met:

  • The certificate inspection is configured in the firewall policy that has the http-policy-redirect option enabled.
  • A previously authenticated IP-based user record cannot be found by the FortiGate's memory during the SSL handshake.
  • Proxy policy matching needs the FortiGate to see the HTTP request authentication information.

This means that in order to enable user authentication and use webproxy-forward-server in the transparent web proxy policy at the same time, the following best practices should be followed:

  • In the firewall policy that has the http-policy-redirect option enabled, set ssl-ssh-profile to use the deep-inspection profile.
  • Use IP-based authentication rules; otherwise, the webproxy-forward-server setting in the transparent web proxy policy will be ignored.
  • Use a passive authentication method such as FSSO. With FSSO, once the user is authenticated as a domain user by a successful login, the web traffic from the user's client will always be forwarded to the upstream proxy as long as the authenticated user remains unexpired. If the authentication method is an active authentication method (such as basic, digest, NTLM, negotiate, form, and so on), the first session containing authentication information will bypass the forward server, but the following sessions will be connected through the upstream proxy.

Sample configuration

On the downstream FortiGate proxy, there are two category proxy addresses used in two separate transparent web proxy policies as the destination address:

  • In the policy with upstream_proxy_1 as the forward server, the proxy address category_infotech is used to match URLs in the information technology category.

  • In the policy with upstream_proxy_2 as the forward server, the proxy address category_social is used to match URLs in the social media category.

To configure forwarding requests to transparent web proxies:
  1. Configure the proxy forward servers:
    config web-proxy forward-server
        edit "upStream_proxy_1"
            set ip 172.16.200.20
        next
        edit "upStream_proxy_2"
            set ip 172.16.200.46
        next
    end
  2. Configure the web proxy addresses:
    config firewall proxy-address
        edit "category_infotech"
            set type category
            set host "all"
            set category 52
        next
        edit "category_social"
            set type category
            set host "all"
            set category 37
        next
    end
  3. Configure the firewall policy:
    config firewall policy
        edit 1
            set srcintf "port10"
            set dstintf "port9"
            set srcaddr "all"
            set dstaddr "all"
            set action accept
            set schedule "always"
            set service "ALL"
            set utm-status enable
            set inspection-mode proxy
            set http-policy-redirect enable
            set ssl-ssh-profile "deep-inspection"
            set av-profile "av"
            set nat enable
        next
    end
  4. Configure the proxy policies:
    config firewall proxy-policy
        edit 1
            set proxy transparent-web
            set srcintf "port10"
            set dstintf "port9"
            set srcaddr "all"
            set dstaddr "category_infotech"
            set service "webproxy"
            set action accept
            set schedule "always"
            set logtraffic all
            set webproxy-forward-server "upStream_proxy_1"
            set utm-status enable
            set ssl-ssh-profile "deep-inspection"
            set av-profile "av"
        next
        edit 2
            set proxy transparent-web
            set srcintf "port10"
            set dstintf "port9"
            set srcaddr "all"
            set dstaddr "category_social"
            set service "webproxy"
            set action accept
            set schedule "always"
            set logtraffic all
            set webproxy-forward-server "upStream_proxy_2"
            set utm-status enable
            set ssl-ssh-profile "deep-inspection"
            set av-profile "av"
        next
    end