Proxy address

The following proxy address types are available for firewall policies:

• Host regex match
• URL pattern
• URL category
• URL list
• HTTP method
• HTTP header
• User agent
• Advanced (source)
• Advanced (destination)

Fast policy match

The fast policy match function improves the performance of IPv4 explicit and transparent web proxies on FortiProxy devices.

When enabled, after the firewall policies are configured, the FortiProxy builds a fast searching table based on the different firewall policy matching criteria. When fast policy matching is disabled, web proxy traffic is compared to the policies one at a time from the beginning of the policy list.

Fast policy matching is enabled by default, and can be configured with the following CLI command:

config web-proxy global
    set fast-policy-match {enable | disable}
end

Host regex match

In this address type, a user can create a hostname as a regular expression to match the Host field in the Layer 7 header of a packet. Once created, the hostname address can be selected as a destination of a firewall policy. This means that a policy will only allow or block requests that match the regular expression.

This example creates a host regex match address with the pattern qa.[a-z]*.com.

To create a host regex match address in the GUI:

1. Go to Policy & Objects > Addresses.

2. Click Create New > Address.

3. Set the following:

   • Category to Proxy Address,

   • Name to Host Regex,

   • Type to Host Regex Match, and

   • Host Regex Pattern to qa.[a‑z]*.com.

   

4. Click OK.

To create a host regex match address in the CLI:

config firewall proxy-address
    edit "Host Regex"
        set type host-regex
        set host-regex "qa.[a-z]*.com"
    next
end

URL pattern

In this address type, a user can create a URL path as a regular expression. Once created, the path address can be selected as a destination of a firewall policy. This means that a policy will only allow or block requests that match the regular expression.

This example creates a URL pattern address with the pattern /filetypes/.

To create a URL pattern address in the GUI:

1. Go to Policy & Objects > Addresses.

2. Click Create New > Address.

3. Set the following:

   • Category to Proxy Address,

   • Name to URL Regex,

   • Type to URL Pattern,

   • Host to all, and

   • URL Path Regex to /filetypes/.

   

4. Click OK.

To create a URL pattern address in the CLI:

config firewall proxy-address
    edit "URL Regex"
        set type url
        set host "all"
        set path "/filetypes/"
    next
end

URL category

In this address type, a user can create a URL category based on a FortiGuard URL ID. Once created, the address can be selected as a destination of a firewall policy. This means that a policy will only allow or block requests that match the URL category.

The example creates a URL category address for URLs in the Education category. For more information about categories, see https://fortiguard.com/webfilter/categories.

For information about creating and using custom local and remote categories, see Web Rating Overrides.

To create a URL category address in the GUI:

1. Go to Policy & Objects > Addresses.
2. Click Create New > Address.
3. Set the following:
   • Category to Proxy Address,
   • Name to url-category,
   • Type to URL Category,
   • Host to all, and
   • URL Category to Education.

   

4. Click OK.

To create a URL category address in the CLI:

config firewall proxy-address
    edit "url-category"
        set type category
        set host "all"
        set category 30
    next
end

To see a list of all the categories and their numbers, when editing the address, enter set category ?.

URL list

In this address type, a user can create a URL list based on an existing web filter URL list that you created under Security Profiles > Web Filter URL List. Once created, the URL list can be selected as a destination of a firewall policy. This means that a policy will only allow or block requests that match the URL list.

To create a URL list address in the GUI:

1. Go to Policy & Objects > Addresses.
2. Click Create New > Address.
3. Set the following:
   • Category to Proxy Address,
   • Name to url-list,
   • Type to URL List,
   • Host to all, and
   • URL List to one that is available. If no URL list is available, create one under Security Profiles > Web Filter URL List.

   

4. Click OK.

To create a URL list address in the CLI:

1. If no web filter URL list is defined, use the config webfilter url-list command to define one.

2. Create a URL list address by referencing the web filter URL list:

   config firewall proxy-address

   edit "url-list"

   set type url-list

   set host "all"

   set url list "example-list"

   next

   end

HTTP method

In this address type, a user can create an address based on the HTTP request methods that are used. Multiple method options are supported, including: CONNECT, DELETE, GET, HEAD, OPTIONS, POST, PUT, and TRACE. Once created, the address can be selected as a source of a firewall policy. This means that a policy will only allow or block requests that match the selected HTTP method.

The example creates a HTTP method address that uses the GET method.

To create a HTTP method address in the GUI:

1. Go to Policy & Objects > Addresses.

2. Click Create New > Address.

3. Set the following:

   • Category to Proxy Address,

   • Name to method_get,

   • Type to HTTP Method,

   • Host to all, and

   • Request Method to GET.

4. Click OK.

To create a HTTP method address in the CLI:

config firewall proxy-address
    edit "method_get"
        set type method
        set host "all"
        set method get
    next
end

User agent

In this address type, a user can create an address based on the names of the browsers that are used as user agents. Multiple browsers are supported, such as Chrome, Firefox, Internet Explorer, and others. Once created, the address can be selected as a source of a firewall policy. This means that a policy will only allow or block requests from the specified user agent.

This example creates a user agent address for Google Chrome.

To create a user agent address in the GUI:

1. Go to Policy & Objects > Addresses.

2. Click Create New > Address.

3. Set the following:

   • Category to Proxy Address,

   • Name to UA-Chrome,

   • Type to User Agent,

   • Host to all, and

   • User Agent to Google Chrome.

4. Click OK.

To create a user agent address in the CLI:

config firewall proxy-address
    edit "UA-Chrome"
        set type ua
        set host "all"
        set ua chrome
    next
end

HTTP header

In this address type, a user can create a HTTP header as a regular expression. Once created, the header address can be selected as a source of a firewall policy. This means that a policy will only allow or block requests where the HTTP header matches the regular expression.

This example creates a HTTP header address with the pattern Q[A-B].

To create a HTTP header address in the GUI:

1. Go to Policy & Objects > Addresses.

2. Click Create New > Address.

3. Set the following:

   • Category to Proxy Address,

   • Name to HTTP-header,

   • Type to HTTP Header,

   • Host to all,

   • Header Name to Header_Test, and

   • Header Regex to Q[A-B].

4. Click OK.

To create a HTTP header address in the CLI:

config firewall proxy-address
    edit "method_get"
        set type header
        set host "all"
        set header-name "Header_Test"
        set header "Q[A-B]"
    next
end

Advanced (source)

In this address type, a user can create an address based on multiple parameters, including HTTP method, User Agent, and HTTP header. Once created, the address can be selected as a source of a firewall policy. This means that a policy will only allow or block requests that match the selected address.

This example creates an address that uses the get method, a user agent for Google Chrome, and an HTTP header with the pattern Q[A-B].

To create an advanced (source) address in the GUI:

1. Go to Policy & Objects > Addresses.

2. Click Create New > Address.

3. Set the following:

   • Category to Proxy Address,

   • Name to advanced_src,

   • Type to Advanced (Source),

   • Host to all,

   • Request Method to GET,

   • User Agent to Google Chrome, and

   • HTTP header to Header_Test : Q[A-B].

4. Click OK.

To create an advanced (source) address in the CLI:

config firewall proxy-address
    edit "advance_src"
        set type src-advanced
        set host "all"
        set method get
        set ua chrome
        config header-group
            edit 1
                set header-name "Header_Test"
                set header "Q[A-B]"
            next
        end
    next
end

Advanced (destination)

In this address type, a user can create an address based on URL pattern and URL category parameters. Once created, the address can be selected as a destination of a firewall policy. This means that a policy will only allow or block requests that match the selected address.

This example creates an address with the URL pattern /about that are in the Education category. For more information about categories, see https://fortiguard.com/webfilter/categories.

To create an advanced (destination) address in the GUI:

1. Go to Policy & Objects > Addresses.

2. Click Create New > Address.

3. Set the following:

   • Category to Proxy Address,

   • Name to Advanced-dst,

   • Type to Advanced (Destination),

   • Host to all,

   • URL Path Regex to /about, and

   • URL Category to Education.

   

4. Click OK.

To create an advanced (destination) address in the CLI:

config firewall proxy-address
    edit "Advanced-dst"
        set type dst-advanced
        set host "ubc"
        set path "/about"
        set category 30
    next
end