Fortinet black logo

Administration Guide

Transparent proxy

Transparent proxy

In a transparent proxy deployment, the user's client software, such as a browser, is unaware that it is communicating with a proxy.

Users request internet content as usual, without any special client configuration, and the proxy serves their requests. FortiGate also allows users to configure in transparent proxy mode.

To redirect HTTPS traffic, SSL inspection is required.

Note

If the base firewall policy successfully redirects to the proxy policy then antivirus and web filter profiles configured on the firewall policy will not be applied. Security profiles should be configured on the proxy policy.

To configure transparent proxy in the GUI:
  1. Configure a regular firewall policy with HTTP redirect:

    1. Go to Policy & Objects > Firewall Policy.

    2. Click Create New.

    3. Name the policy appropriately, set the Incoming Interface to port2, and set the Outgoing Interface to port1.

    4. Also set Source and Destination to all, Schedule to always, Service to ALL, and Action to ACCEPT.

    5. Set Inspection Mode to Proxy-based and SSL Inspection to deep-inspection.

    6. Configure the remaining settings as needed.

    7. Click OK.

    8. Note

      By default, HTTP redirect can only be enabled in the CLI. Enable Policy Advanced Options in Feature Visibility to configure it in the GUI. See Feature visibility on page 1 for more information.

  2. Configure a transparent proxy policy:

    1. Go to Policy & Objects > Proxy Policy.

    2. Click Create New.

    3. Set Proxy Type to Transparent Web, set the Incoming Interface to port2, and set the Outgoing Interface to port1.

    4. Also set Source and Destination to all, Scheduleto always, Service to webproxy, and Action to ACCEPT.

    5. Configure the remaining settings as needed.

    6. Click OK to create the policy.

    Note

    This example creates a basic policy. If required, security profiles can be enabled, and deep SSL inspection can be selected to inspect HTTPS traffic.

  3. No special configuration is required on the client to use FortiGate transparent proxy. As the client is using the FortiGate as its default gateway, requests will first hit the regular firewall policy, and then be redirected to the transparent proxy policy.

To configure transparent proxy in the CLI:
  1. Configure a regular firewall policy with HTTP redirect:

    config firewall policy
        edit 1
            set name "LAN To WAN"
            set srcintf "port2"
            set dstintf "port1"
            set srcaddr "all"
            set dstaddr "all"
            set action accept
            set schedule "always"
            set service "ALL"
            set inspection-mode proxy
            set http-policy-redirect enable
            set fsso disable
            set ssl-ssh-profile "deep-inspection"
            set nat enable
        next
    end
  2. Configure a transparent proxy policy:

    config firewall proxy-policy
        edit 5
            set name "proxy-policy-transparent"
            set proxy transparent-web
            set srcintf "port2"
            set dstintf "port1"
            set srcaddr "all"
            set dstaddr "all"
            set service "webproxy"
            set action accept
            set schedule "always"
        next
    end
    Note

    This example creates a basic policy. If required, security profiles can be enabled, and deep SSL inspection can be selected to inspect HTTPS traffic.

  3. No special configuration is required on the client to use FortiGate transparent proxy. As the client is using the FortiGate as its default gateway, requests will first hit the regular firewall policy, and then be redirected to the transparent proxy policy.

Transparent proxy

In a transparent proxy deployment, the user's client software, such as a browser, is unaware that it is communicating with a proxy.

Users request internet content as usual, without any special client configuration, and the proxy serves their requests. FortiGate also allows users to configure in transparent proxy mode.

To redirect HTTPS traffic, SSL inspection is required.

Note

If the base firewall policy successfully redirects to the proxy policy then antivirus and web filter profiles configured on the firewall policy will not be applied. Security profiles should be configured on the proxy policy.

To configure transparent proxy in the GUI:
  1. Configure a regular firewall policy with HTTP redirect:

    1. Go to Policy & Objects > Firewall Policy.

    2. Click Create New.

    3. Name the policy appropriately, set the Incoming Interface to port2, and set the Outgoing Interface to port1.

    4. Also set Source and Destination to all, Schedule to always, Service to ALL, and Action to ACCEPT.

    5. Set Inspection Mode to Proxy-based and SSL Inspection to deep-inspection.

    6. Configure the remaining settings as needed.

    7. Click OK.

    8. Note

      By default, HTTP redirect can only be enabled in the CLI. Enable Policy Advanced Options in Feature Visibility to configure it in the GUI. See Feature visibility on page 1 for more information.

  2. Configure a transparent proxy policy:

    1. Go to Policy & Objects > Proxy Policy.

    2. Click Create New.

    3. Set Proxy Type to Transparent Web, set the Incoming Interface to port2, and set the Outgoing Interface to port1.

    4. Also set Source and Destination to all, Scheduleto always, Service to webproxy, and Action to ACCEPT.

    5. Configure the remaining settings as needed.

    6. Click OK to create the policy.

    Note

    This example creates a basic policy. If required, security profiles can be enabled, and deep SSL inspection can be selected to inspect HTTPS traffic.

  3. No special configuration is required on the client to use FortiGate transparent proxy. As the client is using the FortiGate as its default gateway, requests will first hit the regular firewall policy, and then be redirected to the transparent proxy policy.

To configure transparent proxy in the CLI:
  1. Configure a regular firewall policy with HTTP redirect:

    config firewall policy
        edit 1
            set name "LAN To WAN"
            set srcintf "port2"
            set dstintf "port1"
            set srcaddr "all"
            set dstaddr "all"
            set action accept
            set schedule "always"
            set service "ALL"
            set inspection-mode proxy
            set http-policy-redirect enable
            set fsso disable
            set ssl-ssh-profile "deep-inspection"
            set nat enable
        next
    end
  2. Configure a transparent proxy policy:

    config firewall proxy-policy
        edit 5
            set name "proxy-policy-transparent"
            set proxy transparent-web
            set srcintf "port2"
            set dstintf "port1"
            set srcaddr "all"
            set dstaddr "all"
            set service "webproxy"
            set action accept
            set schedule "always"
        next
    end
    Note

    This example creates a basic policy. If required, security profiles can be enabled, and deep SSL inspection can be selected to inspect HTTPS traffic.

  3. No special configuration is required on the client to use FortiGate transparent proxy. As the client is using the FortiGate as its default gateway, requests will first hit the regular firewall policy, and then be redirected to the transparent proxy policy.