Summary
Here’s a summary table of FortiWeb’s operation modes with their features and differences.
|
|
Reverse Proxy |
WCCP Mode |
True Transparent Proxy (TTP) |
Transparent Inspection (TI) |
Offline Protection |
|---|---|---|---|---|---|
| Traffic Flow |
Client ⬇ FortiWeb ⬇ Server |
Client ⬇ Firewall ⬇ FortiWeb ⬇ Server |
Client ⬇ FortiWeb (bridged ports) ⬇ Server |
Client ⬇ FortiWeb (bridged ports) ⬇ Server |
Client ⬇ Server (traffic mirrored to FortiWeb) |
| Network Changes | Requires DNS updates to point to FortiWeb’s VIP | No DNS/IP changes | No DNS/IP changes | No DNS/IP changes | No DNS/IP changes |
|
SSL/TLS Proxy |
Yes |
No |
No |
No |
No |
| SSL ciphers | TLS 1.0/1.1/1.2/1.3 | TLS 1.0/1.1/1.2/1.3 | TLS 1.0/1.1/1.2/1.3 | TLS 1.0/1.1/1.2 | TLS 1.0/1.1/1.2 |
| Client IP Preservation | Client IP passed via headers (e.g., X-Forwarded-For); server sees FortiWeb IP | Client IP passed via headers (e.g., X-Forwarded-For); server sees FortiWeb IP | Server sees client’s real IP | Server sees client’s real IP | Server sees client’s real IP |
| Real-Time Blocking | Full blocking capabilities | Full blocking capabilities | Full blocking capabilities | Only reset connections and cannot return any custom block page | Delayed blocking via RST packets (often ineffective) |
| Security Features | Full suite (signatures, ML, request/response modification, etc.) | Full suite except ML based API Protection | Full suite (signatures, ML, request/response modification, etc.) | Limited | Monitoring and alerts only |
| HA Support | Active-Passive, Active-Active (Standard/High Volume) | Active-Passive only | Active-Passive, Standard Active-Active | Active-Passive only | Active-Passive only |
|
Use Cases |
Full protection, SSL offloading, load balancing |
Integration with existing firewalls/routers |
Transparent deployment with client IP preservation |
Passive inspection in rigid network environments |
Monitoring-only scenarios |
|
Pros |
- Full security features - Hides server IP - Supports load balancing/caching |
- No DNS changes - Scalable via WCCP groups |
- Transparent deployment - Client IP preserved - Supports traffic modification |
- Transparent deployment - Low latency |
- No DNS changes - Zero traffic impact |
|
Cons |
- Requires DNS changes - HA required for redundancy |
- Complex configuration - Relies on WCCP devices |
- No Layer 3 features (e.g., load balancing) - Complex bridge setup |
- Limited security features - No TLS 1.3 support |
- No real-time blocking - TCP-only support |