Transparent web proxy forwarding

In FortiOS, there is an option to enable proxy forwarding for transparent web proxy policies and regular firewall policies for HTTP and HTTPS.

In previous versions of FortiOS, you could forward proxy traffic to another proxy server (proxy chaining) with explicit proxy. Now, you can forward web traffic to the upstream proxy without having to reconfigure your browsers or publish a proxy auto-reconfiguration (PAC) file.

Once configured, the FortiGate forwards traffic generated by a client to the upstream proxy. The upstream proxy then forwards it to the server.

To configure proxy forwarding:

1. Configure the web proxy forwarding server:

   config web-proxy forward-server
       edit "upStream_proxy_1"
           set ip 172.16.200.20
           set healthcheck enable
           set monitor "http://www.google.ca"
       next
   end

2. Append the web proxy forwarding server to a firewall policy:

   config firewall policy
       edit 1
           set name "LAN To WAN"
           set srcintf "port10"
           set dstintf "port9"
           set srcaddr "all"
           set dstaddr "all"
           set action accept
           set schedule "always"
           set service "ALL"
           set utm-status enable
           set logtraffic all
           set webproxy-forward-server "upStream_proxy_1"
           set fsso disable
           set av-profile "av"
           set ssl-ssh-profile "deep-custom"
           set nat enable
       next
   end

Selectively forward web requests to a transparent web proxy

Web traffic over HTTP/HTTPS can be forwarded selectively by the FortiGate's transparent web proxy to an upstream web proxy to avoid overwhelming the proxy server. Traffic can be selected by specifying the proxy address, which can be based on a FortiGuard URL category.

The FortiGuard web filter service must be enabled on the downstream FortiGate.

Topology

Forwarding behavior

The forward server will be ignored if the proxy policy matching for a particular session needs the FortiGate to see authentication information inside the HTTP (plain text) message. For example, assume that user authentication is required and a forward server is configured in the transparent web proxy, and the authentication method is an active method (such as basic). When the user or client sends the HTTP request over SSL with authentication information to the FortiGate, the request cannot be forwarded to the upstream proxy. Instead, it will be forwarded directly to the original web server (assuming deep inspection and http-policy-redirect are enabled in the firewall policy).

The FortiGate will close the session before the client request can be forwarded if all of the following conditions are met:

• The certificate inspection is configured in the firewall policy that has the http-policy-redirect option enabled.
• A previously authenticated IP-based user record cannot be found by the FortiGate's memory during the SSL handshake.
• Proxy policy matching needs the FortiGate to see the HTTP request authentication information.

This means that in order to enable user authentication and use webproxy-forward-server in the transparent web proxy policy at the same time, the following best practices should be followed:

• In the firewall policy that has the http-policy-redirect option enabled, set ssl-ssh-profile to use the deep-inspection profile.
• Use IP-based authentication rules; otherwise, the webproxy-forward-server setting in the transparent web proxy policy will be ignored.
• Use a passive authentication method such as FSSO. With FSSO, once the user is authenticated as a domain user by a successful login, the web traffic from the user's client will always be forwarded to the upstream proxy as long as the authenticated user remains unexpired. If the authentication method is an active authentication method (such as basic, digest, NTLM, negotiate, form, and so on), the first session containing authentication information will bypass the forward server, but the following sessions will be connected through the upstream proxy.

Sample configuration

On the downstream FortiGate proxy, there are two category proxy addresses used in two separate transparent web proxy policies as the destination address:

• In the policy with upstream_proxy_1 as the forward server, the proxy address category_infotech is used to match URLs in the information technology category.

• In the policy with upstream_proxy_2 as the forward server, the proxy address category_social is used to match URLs in the social media category.

To configure forwarding requests to transparent web proxies:

1. Configure the proxy forward servers:

   config web-proxy forward-server
       edit "upStream_proxy_1"
           set ip 172.16.200.20
       next
       edit "upStream_proxy_2"
           set ip 172.16.200.46
       next
   end

2. Configure the web proxy addresses:

   config firewall proxy-address
       edit "category_infotech"
           set type category
           set host "all"
           set category 52
       next
       edit "category_social"
           set type category
           set host "all"
           set category 37
       next
   end

3. Configure the firewall policy:

   config firewall policy
       edit 1
           set srcintf "port10"
           set dstintf "port9"
           set srcaddr "all"
           set dstaddr "all"
           set action accept
           set schedule "always"
           set service "ALL"
           set utm-status enable
           set inspection-mode proxy
           set http-policy-redirect enable
           set ssl-ssh-profile "deep-inspection"
           set av-profile "av"
           set nat enable
       next
   end

4. Configure the proxy policies:

   config firewall proxy-policy
       edit 1
           set proxy transparent-web
           set srcintf "port10"
           set dstintf "port9"
           set srcaddr "all"
           set dstaddr "category_infotech"
           set service "webproxy"
           set action accept
           set schedule "always"
           set logtraffic all
           set webproxy-forward-server "upStream_proxy_1"
           set utm-status enable
           set ssl-ssh-profile "deep-inspection"
           set av-profile "av"
       next
       edit 2
           set proxy transparent-web
           set srcintf "port10"
           set dstintf "port9"
           set srcaddr "all"
           set dstaddr "category_social"
           set service "webproxy"
           set action accept
           set schedule "always"
           set logtraffic all
           set webproxy-forward-server "upStream_proxy_2"
           set utm-status enable
           set ssl-ssh-profile "deep-inspection"
           set av-profile "av"
       next
   end