Benefits and limitations of the transparent modes

Key benefits

• No Network Changes: Works with existing IP/DNS configurations.

• Client IP Preservation: Back-end servers see the original client IP (no NAT).

• Fail-to-Wire: Traffic bypasses FortiWeb during power failures (ensures uptime). See Fail-to-wire for power loss/reboots

Limitations

FortiWeb does not support the following features in TTP and TI modes:

• Features that require Layer 3 (IP layer) control, such as load balancing, HTTP Content Routing

  Transparent modes operate at Layer 2 (Data Link Layer), where FortiWeb acts as a "bump on the wire" (layer 2 bridge) and forwards traffic based on MAC addresses. This limits features that require Layer 3 (IP layer) control, such as round-robin load balancing based on IP/port (part of the back-end server pool configurations in FortiWeb).

• No SSL/TLS offloading

  • What is SSL/TLS offloading?

    SSL/TLS offloading means that FortiWeb functions as an SSL proxy. It terminates the HTTPS connection from the client and presents a server certificate to prove authority for your application domain.

    After inspecting the decrypted traffic, FortiWeb initiates a new connection to the back-end server, which can be either encrypted (HTTPS) or unencrypted (HTTP), depending on the configured settings between FortiWeb and the server. This back-end connection setup is entirely independent of the front-end connection.

  • Is SSL/TLS offloading supported in TTP and TI modes?

    In TTP and TI modes, FortiWeb does not perform SSL/TLS offloading. Instead:

    • The web server terminates the SSL/TLS connection using its own certificate.

    • FortiWeb does not present any certificate to the client, as it does not act as the endpoint of the SSL/TLS connection.

    • You do not need to upload your CA-signed certificate to FortiWeb, as is required in Reverse Proxy mode. Instead, the CA-signed certificate remains solely on your web server.

    • FortiWeb uses its own internal or default certificate only for decrypting SSL traffic to screen out attacks, not for authentication with the client.