Proxy policy addresses

Proxy addresses are designed to be used only by proxy policies.

Fast policy match

The fast policy match function improves the performance of IPv4 explicit and transparent web proxies on FortiGate devices.

When enabled, after the proxy policies are configured, the FortiGate builds a fast searching table based on the different proxy policy matching criteria. When fast policy matching is disabled, web proxy traffic is compared to the policies one at a time from the beginning of the policy list.

Fast policy matching is enabled by default, and can be configured with the following CLI command:

config web-proxy global set fast-policy-match {enable | disable} end

Host regex match

In this address type, a user can create a hostname as a regular expression. Once created, the hostname address can be selected on the destination tab of an explicit proxy policy. This means that a policy will only allow or block requests that match the regular expression.

This example creates a host regex match address with the pattern qa.[a-z]*.com.

To create a host regex match address in the GUI:

1. Go to Policy & Objects > Addresses.
2. Click Create New > Address.
3. Set the following:

l Category to Proxy Address, l Name to Host Regex, l Type to Host Regex Match, and l Host Regex Pattern to qa.[a-z]*.com.

4. Click OK.

To create a host regex match address in the CLI:

config firewall proxy-address edit “Host Regex” set uuid 8e374390-57c9-51e9-9353-ee4469629df8

set type host-regex set host-regex “qa.[a-z]*.com”

next

end

URL pattern

In this address type, a user can create a URL path as a regular expression. Once created, the path address can be selected in the destination tab of an explicit proxy policy. This means that a policy will only allow or block requests that match the regular expression.

This example creates a URL pattern address with the pattern /filetypes/.

To create a URL pattern address in the GUI:

1. Go to Policy & Objects > Addresses.
2. Click Create New > Address.
3. Set the following:

l Category to Proxy Address, l Name to URL Regex, l Type to URL Pattern, l Host to all, and l URL Path Regex to /filetypes/.

4. Click OK.

To create a URL pattern address in the CLI:

config firewall proxy-address edit “URL Regex” set uuid 267dc8e4-57cb-51e9-0cfe-27877bff51d3

set type url set host “all” set path “/filetypes/”

next

end

URL category

In this address type, a user can create a URL category based on a FortiGuard URL ID. Once created, the address can be selected in the destination tab of an explicit proxy policy. This means that a policy will only allow or block requests that match the URL category.

The example creates a URL category address for URLs in the Education category. For more information about categories, see https://fortiguard.com/webfilter/categories.

To create a URL category address in the GUI:

1. Go to Policy & Objects > Addresses.
2. Click Create New > Address.
3. Set the following:

l Category to Proxy Address, l Name to url-category, l Type to URL Category, l Host to all, and l URL Category to Education.

4. Click OK.

To create a URL category address in the CLI:

config firewall proxy-address edit “url-category” set uuid 7a5465d2-57cf-51e9-49fd-0c6b5ad2ff4f

set type category set host “all” set category 30

next

end

To see a list of all the categories and their numbers, when editing the address, enter set category ?.

HTTP method

In this address type, a user can create an address based on the HTTP request methods that are used. Multiple method options are supported, including: CONNECT, DELETE, GET, HEAD, OPTIONS, POST, PUT, and TRACE. Once created, the address can be selected in the source tab of an explicit proxy policy. This means that a policy will only allow or block requests that match the selected HTTP method.

The example creates a HTTP method address that uses the GET method.

To create a HTTP method address in the GUI:

1. Go to Policy & Objects > Addresses.
2. Click Create New > Address.
3. Set the following:
   • Category to Proxy Address, l Name to method_get,
   • Type to HTTP Method, l Host to all, and l Request Method to GET.
4. Click OK.

To create a HTTP method address in the CLI:

config firewall proxy-address edit “method_get” set uuid 1e4d1a02-57d6-51e9-a5c4-73387925b7de

set type method set host “all” set method get

next

end

HTTP header

In this address type, a user can create a HTTP header as a regular expression. Once created, the header address can be selected in the source tab of an explicit proxy policy. This means that a policy will only allow or block requests where the HTTP header matches the regular expression.

This example creates a HTTP header address with the pattern Q[A-B].

To create a HTTP header address in the GUI:

1. Go to Policy & Objects > Addresses.
2. Click Create New > Address.
3. Set the following:
   • Category to Proxy Address, l Name to HTTP-header, l Type to HTTP Header, l Host to all,
   • HeaderName to Header_Test, and l HeaderRegex to Q[A-B].
4. Click OK.

To create a HTTP header address in the CLI:

config firewall proxy-address edit “method_get” set uuid a0f1b806-57e9-51e9-b214-7a1cfafa9bb3

set type header set host “all”

set header-name “Header_Test” set header “Q[A-B]”

next

end

User agent

In this address type, a user can create an address based on the names of the browsers that are used as user agents. Multiple browsers are supported, such as Chrome, Firefox, Internet Explorer, and others. Once created, the address can be selected in the destination tab of an explicit proxy policy. This means that a policy will only allow or block requests from the specified user agent.

This example creates a user agent address for Google Chrome.

To create a user agent address in the GUI:

1. Go to Policy & Objects > Addresses.
2. Click Create New > Address.
3. Set the following:

l Category to Proxy Address, l Name to UA-Chrome, l Type to UserAgent, l Host to all, and l UserAgent to Google Chrome.

4. Click OK.

To create a user agent address in the CLI:

config firewall proxy-address edit “UA-Chrome” set uuid e3550196-57d8-51e9-eed0-115095a7920b

set type ua set host “all” set ua chrome

next

end

Advanced (source)

In this address type, a user can create an address based on multiple parameters, including HTTP method, User Agent, and HTTP header. Once created, the address can be selected in the source tab of an explicit proxy policy. This means that a policy will only allow or block requests that match the selected address.

This example creates an address that uses the get method, a user agent for Google Chrome, and an HTTP header with the pattern Q[A-B].

To create an advanced (source) address in the GUI:

1. Go to Policy & Objects > Addresses.
2. Click Create New > Address.
3. Set the following:

l Category to Proxy Address, l Name to advanced_src, l Type to Advanced (Source), l Host to all, l Request Method to GET, l UserAgent to Google Chrome, and l HTTP header to Header_Test : Q[A-B].

4. Click OK.

To create an advanced (source) address in the CLI:

config firewall proxy-address edit “advance_src” set uuid fb9991d0-57e3-51e9-9fed-855e0bca16c3 set type src-advanced set host “all” set method get set ua chrome config header-group edit 1 set header-name “Header_Test” set header “Q[A-B]”

next

end

next

end

Advanced (destination)

In this address type, a user can create an address based on URL pattern and URL category parameters. Once created, the address can be selected in the destination tab of an explicit proxy policy. This means that a policy will only allow or block requests that match the selected address.

This example creates an address with the URL pattern /about that are in the Education category. For more information about categories, see https://fortiguard.com/webfilter/categories.

To create an advanced (destination) address in the GUI:

1. Go to Policy & Objects > Addresses.
2. Click Create New > Address.
3. Set the following:

l Category to Proxy Address, l Name to Advanced-dst, l Type to Advanced (Destination), l Host to all, l URL Path Regex to /about, and l URL Category to Education.

4. Click OK.

To create an advanced (destination) address in the CLI:

config firewall proxy-address edit “Advanced-dst” set uuid d9c2a0d6-57e5-51e9-8c92-6aa8b3372198 set type dst-advanced set host “ubc” set path “/about” set category 30

next

end

FTP proxy

FTP proxies can be configured on the FortiGate so that FTP traffic can be proxied. When the FortiGate is configured as an FTP proxy, FTP client applications should be configured to send FTP requests to the FortiGate.

To configure explicit FTP proxy in the GUI:

1. Enable and configure explicit FTP proxy:
   1. Go to Network > Explicit Proxy.
   2. Enable Explicit FTP Proxy.
   3. Select port2 as the Listen on Interfaces and set the HTTP Port to 21.
   4. Configure the Default Firewall Policy Action as needed.
   5. Click Apply.
2. Create an explicit FTP proxy policy:
   1. Go to Policy & Objects > Proxy Policy.
   2. Click Create New.
   3. Set Proxy Type to FTP and Outgoing Interface to port1.
   4. Also set Source and Destination to all, Schedule to always, and Action to ACCEPT.
   5. Configure the FTP client application to use the FortiGate IP address.

To configure explicit FTP proxy in the CLI:

1. Enable and configure explicit FTP proxy:

config ftp-proxy explicit set status enable set incoming-port 21

end

config system interface edit “port2” set vdom “vdom1” set ip 10.1.100.1 255.255.255.0 set allowaccess ping https ssh snmp http telnet set type physical set explicit-ftp-proxy enable set snmp-index 12

end

next end

2. Create an explicit FTP proxy policy:

config firewall proxy-policy edit 4 set uuid 2e945a3a-565d-51e9-4fac-5215d287adc0

set proxy ftp set dstintf “port2” set srcaddr “all” set dstaddr “all” set action accept set schedule “always”

next

end

3. Configure the FTP client application to use the FortiGate IP address.

Explicit web proxy

Explicit web proxy can be configured on FortiGate for proxying HTTP and HTTPS traffic.

To deploy explicit proxy, individual client browsers can be manually configured to send requests directly to the proxy, or they can be configured to download proxy configuration instructions from a Proxy Auto-Configuration (PAC) file.

Once explicit proxy is configured on an interface, the interface IP address can be used by client browsers to forward requests directly to the FortiGate. FortiGate also supports PAC file configuration

To configure explicit web proxy in the GUI:

1. Enable and configure explicit web proxy:
   1. Go to Network > Explicit Proxy.
   2. Enable Explicit Web Proxy.
   3. Select port2 as the Listen on Interfaces and set the HTTP Port to 8080.
   4. Configure the remaining settings as needed.
   5. Click Apply.
2. Create an explicit web proxy policy:
3. Go to Policy & Objects > Proxy Policy.
4. Click Create New.
5. Set Proxy Type to Explicit Web and Outgoing Interface to port1.
6. Also set Source and Destination to all, Schedule to always, Service to webproxy, and Action to ACCEPT.
7. Configure a client to use the FortiGate explicit proxy:

Set the FortiGate IP address as the proxy IP address in the browser, or use an automatic configuration script for the PAC file.

To configure explicit web proxy in the CLI:

1. Enable and configure explicit web proxy:

config web-proxy explicit set status enable set ftp-over-http enable set socks enable set http-incoming-port 8080 set ipv6-status enable set unknown-http-version best-effort

end

config system interface

edit “port2” set vdom “vdom1”

set ip 10.1.100.1 255.255.255.0

set allowaccess ping https ssh snmp http telnet set type physical set explicit-web-proxy enable set snmp-index 12

end

next

end

2. Create an explicit web proxy policy:

config firewall proxy-policy edit 1 set uuid 722b6130-13aa-51e9-195b-c4196568d667 set proxy explicit-web set dstintf “port1” set srcaddr “all” set dstaddr “all” set service “webproxy” set action accept set schedule “always” set logtraffic all

next

end

3. Configure a client to use the FortiGate explicit web proxy:

Set the FortiGate IP address as the proxy IP address in the browser, or use an automatic configuration script for the PAC file.