WAN optimization configuration summary
This section includes a client-side and a server-side WAN Optimization configuration summary.:
Client-side configuration summary
WAN optimization profile
Enter the following command to view WAN optimization profile CLI options:
tree wanopt profile
— [profile] –*name (36)
|- transparent
|- comments
|- auth-group (36)
|- <http> — status
|- secure-tunnel
|- byte-caching
|- prefer-chunking
|- tunnel-sharing
|- log-traffic
|- port (1,65535)
|- ssl
|- ssl-port (1,65535)
|- unknown-http-version
+- tunnel-non-http
|- <cifs> — status
|- secure-tunnel
|- byte-caching
|- prefer-chunking
|- tunnel-sharing
|- log-traffic
+- port (1,65535)
|- <mapi> — status
|- secure-tunnel
|- byte-caching
|- tunnel-sharing
|- log-traffic
+- port (1,65535)
|- <ftp> — status
|- secure-tunnel
|- byte-caching
|- prefer-chunking
|- tunnel-sharing
|- log-traffic
+- port (1,65535)
+- <tcp> — status
|- secure-tunnel
|- byte-caching
|- byte-caching-opt
|- tunnel-sharing
|- log-traffic
|- port
|- ssl
+- ssl-port (1,65535)
Local host ID and peer settings
config wanopt settings set host-id client
end
config wanopt peer edit server
set ip 10.10.2.82 end
Security policies
Two client-side WAN optimization security policy configurations are possible. One for active-passive WAN optimization and one for manual WAN optimization.
Active/passive mode on the client-side
config firewall policy edit 2
set srcintf internal set dstintf wan1
set srcaddr all set dstaddr all set action accept
set schedule always set service ALL
set wanopt enable <<< enable WAN optimization
set wanopt-detection active <<< set the mode to active/passive
set wanopt-profile “default” <<< select the wanopt profile
next end
Manual mode on the client-side
config firewall policy edit 2
set srcintf internal set dstintf wan1
set srcaddr all set dstaddr all set action accept
set schedule always set service ALL
set wanopt enable <<< enable WAN optimization
set wanopt-detection off <<< sets the mode to manual
set wanopt-profile “default” <<< select the wanopt profile
set wanopt-peer “server” <<< set the only peer to do wanopt
with (required for manual mode)
next end
server–side configuration summary
Local host ID and peer settings
config wanopt settings
set host-id server end
config wanopt peer edit client
set ip 10.10.2.81
end
Security policies
Two server-side WAN optimization security policy configurations are possible. One for active-passive WAN optimization and one for manual WAN optimization.
Active/passive mode on server-side
config firewall policy
edit 2 <<< the passive mode policy
set srcintf wan1
set dstintf internal set srcaddr all
set dstaddr all set action accept set schedule always set service ALL
set wanopt enable
set wanopt-detection passive
set wanopt-passive-opt transparent end
config firewall explicit-proxy-policy
edit 3 <<< policy that accepts wanopt tunnel connections from the server
set proxy wanopt <<< wanopt proxy type
set dstintf internal set srcaddr all
set dstaddr server-subnet set action accept
set schedule always set service ALL
next end
Manual mode on server-side
config firewall explicit-proxy-policy
edit 3 <<< policy that accepts wanopt tunnel connections from the client
set proxy wanopt <<< wanopt proxy type
set dstintf internal set srcaddr all
set dstaddr server-subnet set action accept
set schedule always set service ALL
next end
Best practices
This is a short list of WAN optimization and explicit proxy best practices.
- WAN optimization tunnel sharing is recommended for similar types of WAN optimization traffic. However, tunnel sharing for different types of traffic is not recommended. For example, aggressive and non-aggressive protocols should not share the same tunnel. See Tunnel sharing on page 2852.
- Active-passive HA is the recommended HA configuration for WAN optimization. See WAN optimization and HA on page 2854.
- Configure WAN optimization authentication with specific peers. Accepting any peer is not recommended as this can be less secure. SeeAccepting any peers on page 2860.
- Set the explicit proxy Default Firewall Policy Action to Deny. This means that a security policy is required to use the explicit web proxy. See The FortiGate explicit web proxy on page 2907.
- Set the explicit FTP proxy Default Firewall Policy Action to Deny. This means that a security policy is required to use the explicit FTP proxy. See General explicit FTP proxy configuration steps on page 2935.
- Do not enable the explicit web or FTP proxy on an interface connected to the Internet. This is a security risk because anyone on the Internet who finds the proxy could use it to hide their source address. If you must enable the proxy on such an interface make sure authentication is required to use the proxy. See General explicit web proxy configuration steps on page 2908.