HTTP to HTTPS redirect for load balancing

You can configure a virtual server with HTTP to HTTPS redirect enabled. When enabled, a virtual server can convert a client's HTTP requests to HTTPS requests. Through this mandatory conversion, HTTP traffic is converted to HTTPS traffic. This conversion improves the security of the user network.

You can only enable this feature by using the CLI. After you enable this feature, traffic flows as follows:

• When FortiGate receives an HTTP request for an external IP, such as 10.1.100.201 in the following example, FortiGate sends an HTTP 303 response back to the original client and redirects HTTP to HTTPS, instead of forwarding the HTTP request to the real backend servers.

• The client browser restarts the TCP session to HTTPS.

• The HTTPS session comes to the FortiGate where a matching firewall policy allows the HTTPS traffic and establishes a secure SSL connection, and then forwards the request to the real backend servers.

To configure virtual server with HTTPS redirect enabled:

1. Create a virtual server with server-type set to http:

   config firewall vip
       edit "virtual-server-http"
           set type server-load-balance
           set extip 10.1.100.201
           set extintf "wan2"
           set server-type http
           set ldb-method round-robin
           set extport 80
           config realservers
               edit 1
                   set ip 172.16.200.44
                   set port 80
               next
               edit 2
                   set ip 172.16.200.55
                   set port 80
               next
           end
       next
   end

2. Create a virtual server with server-type set to https and with the same external IP address:

   config firewall vip
       edit "virtual-server-https"
           set type server-load-balance
           set extip 10.1.100.201
           set extintf "wan2"
           set server-type https
           set ldb-method round-robin
           set extport 443
           config realservers
               edit 1
                   set ip 172.16.200.44
                   set port 443
               next
               edit 2
                   set ip 172.16.200.55
                   set port 443
               next
           end
           set ssl-certificate "Fortinet_CA_SSL"
       next
   end

3. Enable the http-redirect option for the virtual server with server-type set to http:

   config firewall vip
       edit "virtual-server-http"
           <b>set http-redirect enable</b>
       next
   end

4. Add the two virtual servers to a policy:

   config firewall policy
       edit 9
           set srcintf "wan2"
           set dstintf "wan1"
           set srcaddr "all"
           set dstaddr "virtual-server-http" "virtual-server-https"
           set action accept
           set schedule "always"
           set service "ALL"
           set inspection-mode proxy
           set logtraffic all
           set auto-asic-offload disable
           set nat enable
       next
   end