FortiPAM connects to a target through a FortiProxy acting as the gateway Example

Topology

FortiPAM configuration:

1. In the FortiPAM CLI console, enter the following commands to create the FortiProxy gateway:

    config secret gateway  
     edit test_gateway
      set address "172.16.80.112"
      set port 443
      set url-map "tcp"
      set ssl-max-version tls-1.3
     next
    end
   

2. In the FortiPAM CLI console, enter the following commands to create the secret target (Linux server):

    config secret target
     edit "172.16.80.100"
      set class "Other"
      set template "Unix Account (SSH Password)"
      set address "172.16.80.100"
      set gateway "test_gateway" #from step 1
      set creation-time 2023-11-10 09:34:23
      set web-proxy-status  disable
     next
    end
   

FortiProxy configuration:

1. In the FortiProxy CLI console, enter the following commands to configure a VIP:

    config firewall vip 
      edit "test_vip"
       set type access-proxy
       set server-type https
       set extip 172.16.80.112
       set extintf "any"
       set h2-support disable
       set extport 443
       set ssl-certificate "Fortinet_GUI_Server"
       set ssl-min-version tls-1.3
      next
     end

2. In the FortiProxy CLI console, enter the following commands to configure an IPv4 access proxy:

    config firewall access-proxy
     edit "test_access_proxy"
      set vip "test_vip" #from step 1
      set client-cert disable
      set auth-portal enable
      config api-gateway
       edit 1
        set url-map "/tcp"
        set service tcp-forwarding
        config realservers
         edit 1
          set address "all"
         next
        end
       next
      end
     next
    end

3. In the FortiProxy CLI console, enter the following commands to configure a firewall proxy:

    config firewall policy
     edit 1
      set type access-proxy
      set srcintf "any"
      set srcaddr "all"
      set dstaddr "all"
      set action accept
      set schedule "always"
      set access-proxy "test_access_proxy" #from step 2
     next
    end