Adding Web Isolation Profile from FortiProxy to FortiIsolator
FortiIsolator supports adding a web isolation profile from FortiProxy to FortiIsolator.
FortiIsolator setup
Download FortiIsolator CA Certificate
- Connect to FortiIsolator
- Go to Dashboard > System Information > Isolator CA Certificate > Backup/Restore.
- Backup the CA Certificates by pressing Click here. Save the
ca.tgzfile to your local system - Unzip
ca.tgz, you get 3 files under a new folder; these files will be use later when configuring FortiProxy.
Configure Default Policy
- Set the Guest Type to guest only.
- Set Default Isolator Profile Name to system_default.
- Click OK.
|
FortiProxy Header content must be named consistently with the FortiIsolator Profile name that is selected in FortiIsolator Default Policy setting. Currently the profile name "system_default" is being used in the example below. All settings, as in FortiProxy header content, FortiIsolator Isolator Profile Name, and FortiIsolator Default Isolator Profile, are using the same profile name "system_default." |
Example
FortiProxy setup
Enable Explicit Web Proxy On FortiProxy
- Connect to FortiProxy portal GUI: Network > Interfaces > Port2.
- Enable Explicit Web Proxy: Enable.
- Click OK.
Import FortiIsolator CA certificate and Create a new SSL/SSH Inspection Profile
Step 1: Import FortiIsolator CA Certificate.
- Connect to FortiProxy portal GUI by going to System > Certificates > Import > CA Certificate.
- Set Type: File.
- Upload: ca.crt browser to where you save the FortiIsolator CA certificate.
-
Click OK.
This is so that FortiProxy will trust FortiIsolator when dealing with HTTPS traffics.
- Go to System > Certificates > Import > Local Certificate.
- Type: Certificate
- Certificate file: ca.crt
- Key file: ca.key
- Certificate name: FIS_CA_Cert
- Leave eveything else as it is
-
Click OK.
This is so that FortiProxy can use SSL Deep Inspection.
Step 2: Create Web Proxy Profile
-
Go to Policy & Objects > Web Proxy Profile > Create New.
Name: FIS-read-only
Header Client IP: pass
Header Via Request: pass
Header Via Response: pass
Header X Forwarded For: add
Header Front End Https: pass
Header X Authenticated User: pass
Header X Authenticated Groups: pass
Strip Encoding: Disable
Log Header Change: Disable
-
Go to Header > Create New.
ID: 1
Name: fis-isolator-profile
Action: add-to-request
Header Content: system_default
Base64 Encoding: Disable
Add Option: new
Protocol: HTTP HTTPS
Step 3: Create SSL/SSH Inspection Profile
-
Go to Security Profiles > SSL/SSH Inspection > Create New.
Name: deep_inspection2
CA Certificate: FIS_CA_Cert
Leave everything else as is.
- Leave everything else as it is
- Click OK.
Create Isolator Server
To create FIS as Isolator Server
-
Go to Policy & Objects > Isolator Server > Create New.
Name: FIS
Comments: FortiIsolator
Address Type: IP
IP: 192.168.1.18
Port: 8888
- Click OK.
Create Explicit Web Proxy Policy
To create a policy to isolate Unrated/Malicious websites:
-
Go to Policy & Objects > Policy > Create New.
Type: Explicit
Name: FortiProxy_FIS
Explicit Web Proxy: web-proxy
Outgoing Interface: Internet(port1)
Source: all
Destination: all
Schedule: always
Application/Service: webproxy1
Action: ISOLATE
Isolator Server: FIS
Webproxy Profile: FIS-read-only
SSL/SSH Inspection: deep_inspection2
Log Allow Traffic: All Sessions
Log HTTP Transaction: Enable
Enable this policy: Enable
Leave the rest as it is
- Click OK.