What is Sandbox inspection?

What is Sandbox inspection?

Sandbox inspection is a network process that allows files to be sent to a separate device, such as FortiSandbox, to be inspected without risking network security. This allows the detection of threats capable of bypassing other security measures, including zero-day threats.

You can configure your FortiGate device to send suspicious files to FortiSandbox for inspection and analysis. The FortiGate queries scan results and retrieves scan details. The FortiGate can also download malware packages as a complementary AV signature database to block future intrusions by the same malware and download URL packages as complementary web-filtering black lists.

The FortiSandbox uses virtual machines (VMs) running different operating systems to test a file and to determine if it is malicious. If the file exhibits risky behavior, or is found to contain a virus, a new signature can be added to the FortiGuard AntiVirus signature database.

When a FortiGate learns from FortiSandbox that an endpoint is infected, the administrator can quarantine the host, if it is registered to a FortiClient.

FortiSandbox has a VM pool and processes multiple files simultaneously. The amount of time to process a file depends on hardware and the number of sandbox VMs used to scan the file. For example, it can take 60 seconds to five minutes to process a file. FortiSandbox has a robust prefiltering process that, if enabled, reduces the need to inspect every file and reduces processing time. For more information on enabling prefiltering, refer to the FortiSandbox documentation.

Explicit proxy authentication

Explicit proxy authentication

FortiGate supports multiple authentication methods. This topic explains using an external authentication server with Kerberos as the primary and NTLM as the fallback.

To configure Explicit Proxy with authentication:

Enable and configure the explicit proxy

To enable and configure explicit web proxy in the GUI:

  1. Go to Network > Explicit Proxy.
  2. Enable Explicit Web Proxy.
  3. Select port2 as the Listen on Interfaces and set the HTTP Port to 8080.
  4. Configure the remaining settings as needed.
  5. Click Apply.

To enable and configure explicit web proxy in the CLI:

config web-proxy explicit set status enable set ftp-over-http enable set socks enable set http-incoming-port 8080 set ipv6-status enable

set unknown-http-version best-effort

end

config system interface edit “port2” set vdom “vdom1”

set ip 10.1.100.1 255.255.255.0

set allowaccess ping https ssh snmp http telnet set type physical set explicit-web-proxy enable set snmp-index 12

end

next

end

Configure the authentication server and create user groups

Since we are using an external authentication server with Kerberos authentication as the primary and NTLM as the fallback, Kerberos authentication is configured first and then FSSO NTLM authentication is configured.

For successful authorization, the FortiGate checks if user belongs to one of the groups that is permitted in the security policy.

To configure an authentication server and create user groups in the GUI:

  1. Configure Kerberos authentication:
    1. Go to User& Device > LDAP Servers.
    2. Click Create New.
    3. Set the following:
Name ldap-kerberos
Server IP 172.18.62.220
Server Port 389
Common Name Identifier cn
Distinguished Name dc=fortinetqa,dc=local
  1. Click OK
  1. Define Kerberos as an authentication service. This option is only available in the CLI.
  2. Configure FSSO NTLM authentication:

FSSO NTLM authentication is supported in a Windows AD network. FSSO can also provide NTLM authentication service to the FortiGate unit. When a user makes a request that requires authentication, the FortiGate initiates NTLM negotiation with the client browser, but does not process the NTLM packets itself. Instead, it forwards all the NTLM packets to the FSSO service for processing. a. Go to Security Fabric > Fabric Connectors.

  1. Click Create New and select Fortinet Single Sign-On Agent from the SSO/Identity
  2. Set the Name to FSSO, Primary FSSO Agent to 16.200.220, and enter a password. d. Click OK.
  1. Create a user group for Kerberos authentication:
    1. Go to User& Device > UserGroups.
    2. Click Create New.
    3. Set the Name to Ldap-Group, and Type to Firewall.
    4. In the Remote Groups table, click Add, and set the Remote Server to the previously created ldap-kerberos
    5. Click OK.
  2. Create a user group for NTLM authentication:
    1. Go to User& Device > UserGroups.
    2. Click Create New.
    3. Set the Name to NTLM-FSSO-Group, Type to Fortinet Single Sign-On (FSSO), and add FORTINETQA/FSSO as a member.
    4. Click OK.

To configure an authentication server and create user groups in the CLI:

  1. Configure Kerberos authentication:

config user ldap edit “ldap-kerberos” set server “172.18.62.220” set cnid “cn”

set dn “dc=fortinetqa,dc=local”

set type regular

set username “CN=root,CN=Users,DC=fortinetqa,DC=local” set password ENC

6q9ZE0QNH4tp3mnL83IS/BlMob/M5jW3cAbgOqzTBsNTrGD5Adef8BZTquu46NNZ8KWoIoclAMlrGTR0z1IqT8n 7FIDV/nqWKdU0ehgwlqMvPmOW0+S2+kYMhbEj7ZgxiIRrculJIKoZ2gjqCorO3P0BkumbyIW1jAdPTOQb749n4O cEwRYuZ2odHTwWE8NJ3ejGOg== next

end

  1. Define Kerberos as an authentication service:

config user krb-keytab edit “http_service” set pac-data disable

set principal “HTTP/FGT.FORTINETQA.LOCAL@FORTINETQA.LOCAL” set ldap-server “ldap-kerberos” set keytab

“BQIAAABFAAIAEEZPUlRJTkVUUUEuTE9DQUwABEhUVFAAFEZHVC5GT1JUSU5FVFFBLkxPQ0FMAAAAAQAAAAAEAA

EACKLCMonpitnVAAAARQACABBGT1JUSU5FVFFBLkxPQ0FMAARIVFRQABRGR1QuRk9SVElORVRRQS5MT0NBTAAAA

AEAAAAABAADAAiiwjKJ6YrZ1QAAAE0AAgAQRk9SVElORVRRQS5MT0NBTAAESFRUUAAURkdULkZPUlRJTkVUUUEu

TE9DQUwAAAABAAAAAAQAFwAQUHo9uqR9cSkzyxdzKCEXdwAAAF0AAgAQRk9SVElORVRRQS5MT0NBTAAESFRUUAA

URkdULkZPUlRJTkVUUUEuTE9DQUwAAAABAAAAAAQAEgAgzee854Aq1HhQiKJZvV4tL2Poy7hMIARQpK8MCB//BI AAAABNAAIAEEZPUlRJTkVUUUEuTE9DQUwABEhUVFAAFEZHVC5GT1JUSU5FVFFBLkxPQ0FMAAAAAQAAAAAEABEAE

G49vHEiiBghr63Z/lnwYrU=” next

end

  1. Configure FSSO NTLM authentication:

config user fsso edit “1” set server “172.18.62.220” set password ENC

4e2IiorhPCYvSWw4DbthmLdpJuvIFXpayG0gk1DHZ6TYQPMLjuiG9k7/+qRneCtztBfbzRr1pcyC6Zj3det2pvW dKchMShyz67v4c7s6sIRf8GooPBRZJtg03cmPg0vd/fT1xD393hiiMecVGCHXOBHAJMkoKmPNjc3Ga/e78rWYeH uWK1lu2Bk64EXxKFt799UgBA== next

end

  1. Create a user group for Kerberos authentication:

config user group edit “Ldap-Group” set member “ldap” “ldap-kerberos”

next

end

  1. Create a user group for NTLM authentication:

config user group edit “NTLM-FSSO-Group” set group-type fsso-service set member “FORTINETQA/FSSO”

next end

Create an authentication scheme and rules

Explicit proxy authentication is managed by authentication schemes and rules. An authentication scheme must be created first, and then the authentication rule.

To create an authentication scheme and rules in the GUI:

  1. Create an authentication scheme:
    1. Go to Policy & Objects > Authentication Rules.
    2. Click Create New > Authentication Schemes.
    3. Set the Name to Auth-scheme-Negotiate and select Negotiate as the Method. Click OK.
  2. Create an authentication rule:
    1. Go to Policy & Objects > Authentication Rules.
    2. Click Create New > Authentication Rules.
    3. Set the Name to Auth-Rule, Source Address to all, and Protocol to HTTP.
    4. Enable Authentication Scheme, and select the just created Auth-scheme-Negotiate e. Click OK.

To create an authentication scheme and rules in the CLI:

  1. Create an authentication scheme:

config authentication scheme edit “Auth-scheme-Negotiate” set method negotiate      <<< Accepts both Kerberos and NTLM as fallback next

end

  1. Create an authentication rule:

config authentication rule edit “Auth-Rule” set status enable set protocol http set srcaddr “all” set ip-based enable

set active-auth-method “Auth-scheme-Negotiate” set comments “Testing”

next

end

Create an explicit proxy policy and assign a user group to the policy

To create an explicit proxy policy and assign a user group to it in the GUI:

  1. Go to Policy & Object > Proxy Policy.
  2. Click Create New.
  3. Set Proxy Type to Explicit Web and Outgoing Interface to port1.
  4. Set Source to all, and the just created user groups NTLM-FSSO-Group and Ldap-Group.
  5. Also set Destination to all, Schedule to always, Service to webproxy, and Action to ACCEPT.
  6. Click OK.

To create an explicit proxy policy and assign a user group to it in the CLI:

config firewall proxy-policy edit 1 set uuid 722b6130-13aa-51e9-195b-c4196568d667 set proxy explicit-web set dstintf “port1” set srcaddr “all” set dstaddr “all” set service “web” set action accept set schedule “always” set logtraffic all

set groups “NTLM-FSSO-Group” “Ldap-Group” set av-profile “av”

set ssl-ssh-profile “deep-custom”

next

end

Verify the configuration

Log in using a domain and system that would be authenticated using the Kerberos server, then enter the diagnose wad user list CLI command to verify:

# diagnose wad user list

ID: 8, IP: 10.1.100.71, VDOM: vdom1 user name : test1@FORTINETQA.LOCAL

duration : 389 auth_type : IP

auth_method : Negotiate

pol_id     : 1 g_id    : 1 user_based : 0

expire      : no

LAN: bytes_in=4862 bytes_out=11893 WAN: bytes_in=7844 bytes_out=1023

Log in using a system that is not part of the domain. The NTLM fallback server should be used:

# diagnose wad user list

ID: 2, IP: 10.1.100.202, VDOM: vdom1 user name : TEST31@FORTINETQA

duration   : 7 auth_type : IP auth_method : NTLM

pol_id     : 1 g_id    : 5 user_based : 0

expire      : no

LAN:

bytes_in=6156 bytes_out=16149 WAN: bytes_in=7618 bytes_out=1917

 

Proxy policy security profiles

Proxy policy security profiles

Web proxy policies support most security profile types.

Explicit web proxy policy

The security profiles supported by explicit web proxy policies are:

  • AntiVirus, l Web Filter, l Application Control, l IPS, l DLP Sensor, l ICAP,
  • Web Application Firewall, and l SSL Inspection.

To configure security profiles on an explicit web proxy policy in the GUI:

  1. Go to Policy & Objects > Proxy Policy.
  2. Click Create New.
  3. Set the following:
Proxy Type Explicit Web
Outgoing Interface port1
Source all
Destination all
Schedule always
Service webproxy
Action ACCEPT
  1. In the Firewall / Network Options section, set Protocol Options to default.
  2. In the Security Profiles section, make the following selections (for this example, these profiles have all already been created):
AntiVirus av
Web Filter urlfiler
Application Control app
IPS Sensor-1
DLP Sensor dlp
ICAP default
Web Application Firewall default
SSL Inspection deep-inspection
  1. Click OK to create the policy.

To configure security profiles on an explicit web proxy policy in the CLI:

config firewall proxy-policy edit 1 set uuid c8a71a2c-54be-51e9-fa7a-858f83139c70 set proxy explicit-web set dstintf “port1” set srcaddr “all” set dstaddr “all” set service “web” set action accept set schedule “always” set utm-status enable set av-profile “av” set webfilter-profile “urlfilter” set dlp-sensor “dlp” set ips-sensor “sensor-1” set application-list “app” set icap-profile “default” set waf-profile “default” set ssl-ssh-profile “deep-inspection”

next end

Transparent proxy

The security profiles supported by explicit web proxy policies are:

  • AntiVirus, l Web Filter, l Application Control, l IPS, l DLP Sensor, l ICAP,
  • Web Application Firewall, and l SSL Inspection.

To configure security profiles on a transparent proxy policy in the GUI:

  1. Go to Policy & Objects > Proxy Policy.
  2. Click Create New.
  3. Set the following:
Proxy Type Explicit Web
Incoming Interfae port2
Outgoing Interface port1
Source all
Destination all
Schedule always
Service webproxy
Action ACCEPT
  1. In the Firewall / Network Options section, set Protocol Options to default.
  2. In the Security Profiles section, make the following selections (for this example, these profiles have all already been created):
AntiVirus av
Web Filter urlfiler
Application Control app
IPS Sensor-1
DLP Sensor dlp
ICAP default
Web Application Firewall default
SSL Inspection deep-inspection
  1. Click OK to create the policy.

To configure security profiles on a transparent proxy policy in the CLI:

config firewall proxy-policy edit 2 set uuid 8fb05036-56fc-51e9-76a1-86f757d3d8dc set proxy transparent-web set srcintf “port2” set dstintf “port1” set srcaddr “all” set dstaddr “all” set service “webproxy” set action accept set schedule “always” set utm-status enable set av-profile “av” set webfilter-profile “urlfilter” set dlp-sensor “dlp” set ips-sensor “sensor-1” set application-list “app” set icap-profile “default” set waf-profile “default” set ssl-ssh-profile “certificate-inspection”

next

end

FTP proxy

The security profiles supported by explicit web proxy policies are:

l AntiVirus, l Application Control, l IPS, and l DLP Sensor.

To configure security profiles on an FTP proxy policy in the GUI:

  1. Go to Policy & Objects > Proxy Policy.
  2. Click Create New.
  3. Set the following:
Proxy Type FTP
Outgoing Interface port1
Source all
Destination all
Schedule always
Action ACCEPT
  1. In the Firewall / Network Options section, set Protocol Options to default.
  2. In the Security Profiles section, make the following selections (for this example, these profiles have all already been created):
AntiVirus av
Application Control app
IPS Sensor-1
DLP Sensor dlp
  1. Click OK to create the policy.

To configure security profiles on an FTP proxy policy in the CLI:

config firewall proxy-policy edit 3 set uuid cb89af34-54be-51e9-4496-c69ccfc4d5d4

set proxy ftp set dstintf “port1” set srcaddr “all” set dstaddr “all” set action accept set schedule “always” set utm-status enable set av-profile “av” set dlp-sensor “dlp” set ips-sensor “sensor-1” set application-list “app”

next

end

Proxy policy addresses

Proxy policy addresses

Proxy addresses are designed to be used only by proxy policies.

Fast policy match

The fast policy match function improves the performance of IPv4 explicit and transparent web proxies on FortiGate devices.

When enabled, after the proxy policies are configured, the FortiGate builds a fast searching table based on the different proxy policy matching criteria. When fast policy matching is disabled, web proxy traffic is compared to the policies one at a time from the beginning of the policy list.

Fast policy matching is enabled by default, and can be configured with the following CLI command:

config web-proxy global set fast-policy-match {enable | disable} end

Host regex match

In this address type, a user can create a hostname as a regular expression. Once created, the hostname address can be selected on the destination tab of an explicit proxy policy. This means that a policy will only allow or block requests that match the regular expression.

This example creates a host regex match address with the pattern qa.[a-z]*.com.

To create a host regex match address in the GUI:

  1. Go to Policy & Objects > Addresses.
  2. Click Create New > Address.
  3. Set the following:

l Category to Proxy Address, l Name to Host Regex, l Type to Host Regex Match, and l Host Regex Pattern to qa.[a-z]*.com.

  1. Click OK.

To create a host regex match address in the CLI:

config firewall proxy-address edit “Host Regex” set uuid 8e374390-57c9-51e9-9353-ee4469629df8

set type host-regex set host-regex “qa.[a-z]*.com”

next

end

URL pattern

In this address type, a user can create a URL path as a regular expression. Once created, the path address can be selected in the destination tab of an explicit proxy policy. This means that a policy will only allow or block requests that match the regular expression.

This example creates a URL pattern address with the pattern /filetypes/.

To create a URL pattern address in the GUI:

  1. Go to Policy & Objects > Addresses.
  2. Click Create New > Address.
  3. Set the following:

l Category to Proxy Address, l Name to URL Regex, l Type to URL Pattern, l Host to all, and l URL Path Regex to /filetypes/.

  1. Click OK.

To create a URL pattern address in the CLI:

config firewall proxy-address edit “URL Regex” set uuid 267dc8e4-57cb-51e9-0cfe-27877bff51d3

set type url set host “all” set path “/filetypes/”

next

end

URL category

In this address type, a user can create a URL category based on a FortiGuard URL ID. Once created, the address can be selected in the destination tab of an explicit proxy policy. This means that a policy will only allow or block requests that match the URL category.

The example creates a URL category address for URLs in the Education category. For more information about categories, see https://fortiguard.com/webfilter/categories.

To create a URL category address in the GUI:

  1. Go to Policy & Objects > Addresses.
  2. Click Create New > Address.
  3. Set the following:

l Category to Proxy Address, l Name to url-category, l Type to URL Category, l Host to all, and l URL Category to Education.

  1. Click OK.

To create a URL category address in the CLI:

config firewall proxy-address edit “url-category” set uuid 7a5465d2-57cf-51e9-49fd-0c6b5ad2ff4f

set type category set host “all” set category 30

next

end

To see a list of all the categories and their numbers, when editing the address, enter set category ?.

HTTP method

In this address type, a user can create an address based on the HTTP request methods that are used. Multiple method options are supported, including: CONNECT, DELETE, GET, HEAD, OPTIONS, POST, PUT, and TRACE. Once created, the address can be selected in the source tab of an explicit proxy policy. This means that a policy will only allow or block requests that match the selected HTTP method.

The example creates a HTTP method address that uses the GET method.

To create a HTTP method address in the GUI:

  1. Go to Policy & Objects > Addresses.
  2. Click Create New > Address.
  3. Set the following:
    • Category to Proxy Address, l Name to method_get,
    • Type to HTTP Method, l Host to all, and l Request Method to GET.
  4. Click OK.

To create a HTTP method address in the CLI:

config firewall proxy-address edit “method_get” set uuid 1e4d1a02-57d6-51e9-a5c4-73387925b7de

set type method set host “all” set method get

next

end

HTTP header

In this address type, a user can create a HTTP header as a regular expression. Once created, the header address can be selected in the source tab of an explicit proxy policy. This means that a policy will only allow or block requests where the HTTP header matches the regular expression.

This example creates a HTTP header address with the pattern Q[A-B].

To create a HTTP header address in the GUI:

  1. Go to Policy & Objects > Addresses.
  2. Click Create New > Address.
  3. Set the following:
    • Category to Proxy Address, l Name to HTTP-header, l Type to HTTP Header, l Host to all,
    • HeaderName to Header_Test, and l HeaderRegex to Q[A-B].
  4. Click OK.

To create a HTTP header address in the CLI:

config firewall proxy-address edit “method_get” set uuid a0f1b806-57e9-51e9-b214-7a1cfafa9bb3

set type header set host “all”

set header-name “Header_Test” set header “Q[A-B]”

next

end

User agent

In this address type, a user can create an address based on the names of the browsers that are used as user agents. Multiple browsers are supported, such as Chrome, Firefox, Internet Explorer, and others. Once created, the address can be selected in the destination tab of an explicit proxy policy. This means that a policy will only allow or block requests from the specified user agent.

This example creates a user agent address for Google Chrome.

To create a user agent address in the GUI:

  1. Go to Policy & Objects > Addresses.
  2. Click Create New > Address.
  3. Set the following:

l Category to Proxy Address, l Name to UA-Chrome, l Type to UserAgent, l Host to all, and l UserAgent to Google Chrome.

  1. Click OK.

To create a user agent address in the CLI:

config firewall proxy-address edit “UA-Chrome” set uuid e3550196-57d8-51e9-eed0-115095a7920b

set type ua set host “all” set ua chrome

next

end

Advanced (source)

In this address type, a user can create an address based on multiple parameters, including HTTP method, User Agent, and HTTP header. Once created, the address can be selected in the source tab of an explicit proxy policy. This means that a policy will only allow or block requests that match the selected address.

This example creates an address that uses the get method, a user agent for Google Chrome, and an HTTP header with the pattern Q[A-B].

To create an advanced (source) address in the GUI:

  1. Go to Policy & Objects > Addresses.
  2. Click Create New > Address.
  3. Set the following:

l Category to Proxy Address, l Name to advanced_src, l Type to Advanced (Source), l Host to all, l Request Method to GET, l UserAgent to Google Chrome, and l HTTP header to Header_Test : Q[A-B].

  1. Click OK.

To create an advanced (source) address in the CLI:

config firewall proxy-address edit “advance_src” set uuid fb9991d0-57e3-51e9-9fed-855e0bca16c3 set type src-advanced set host “all” set method get set ua chrome config header-group edit 1 set header-name “Header_Test” set header “Q[A-B]”

next

end

next

end

Advanced (destination)

In this address type, a user can create an address based on URL pattern and URL category parameters. Once created, the address can be selected in the destination tab of an explicit proxy policy. This means that a policy will only allow or block requests that match the selected address.

This example creates an address with the URL pattern /about that are in the Education category. For more information about categories, see https://fortiguard.com/webfilter/categories.

To create an advanced (destination) address in the GUI:

  1. Go to Policy & Objects > Addresses.
  2. Click Create New > Address.
  3. Set the following:

l Category to Proxy Address, l Name to Advanced-dst, l Type to Advanced (Destination), l Host to all, l URL Path Regex to /about, and l URL Category to Education.

  1. Click OK.

To create an advanced (destination) address in the CLI:

config firewall proxy-address edit “Advanced-dst” set uuid d9c2a0d6-57e5-51e9-8c92-6aa8b3372198 set type dst-advanced set host “ubc” set path “/about” set category 30

next

end

FTP Proxy

FTP proxy

FTP proxies can be configured on the FortiGate so that FTP traffic can be proxied. When the FortiGate is configured as an FTP proxy, FTP client applications should be configured to send FTP requests to the FortiGate.

To configure explicit FTP proxy in the GUI:

  1. Enable and configure explicit FTP proxy:
    1. Go to Network > Explicit Proxy.
    2. Enable Explicit FTP Proxy.
    3. Select port2 as the Listen on Interfaces and set the HTTP Port to 21.
    4. Configure the Default Firewall Policy Action as needed.
    5. Click Apply.
  2. Create an explicit FTP proxy policy:
    1. Go to Policy & Objects > Proxy Policy.
    2. Click Create New.
    3. Set Proxy Type to FTP and Outgoing Interface to port1.
    4. Also set Source and Destination to all, Schedule to always, and Action to ACCEPT.
    5. Configure the FTP client application to use the FortiGate IP address.

To configure explicit FTP proxy in the CLI:

  1. Enable and configure explicit FTP proxy:

config ftp-proxy explicit set status enable set incoming-port 21

end

config system interface edit “port2” set vdom “vdom1” set ip 10.1.100.1 255.255.255.0 set allowaccess ping https ssh snmp http telnet set type physical set explicit-ftp-proxy enable set snmp-index 12

end

next end

  1. Create an explicit FTP proxy policy:

config firewall proxy-policy edit 4 set uuid 2e945a3a-565d-51e9-4fac-5215d287adc0

set proxy ftp set dstintf “port2” set srcaddr “all” set dstaddr “all” set action accept set schedule “always”

next

end

  1. Configure the FTP client application to use the FortiGate IP address.

Transparent proxy

Transparent proxy

In a transparent proxy deployment, the user’s client software, such as a browser, is unaware that it is communicating with a proxy.

Users request Internet content as usual, without any special client configuration, and the proxy serves their requests. FortiGate also allows user to configure in transparent proxy mode.

To configure transparent proxy in the GUI:

  1. Configure a regular firewall policy with HTTP redirect:
    1. Go to Policy & Objects > IPv4 Policy.
    2. Click Create New.
    3. Name the policy appropriately, set the Incoming Interface to port2, and set the Outgoing Interface to port1.
    4. Also set Source and Destination to all, Schedule to always, Service to ALL, and Action to ACCEPT.
    5. Set Inspection Mode to Proxy-based and SSL Inspection to deep-inspection.
    6. Configure the remaining settings as needed.
    7. Click OK.
  2. Configure a transparent proxy policy:
  3. Go to Policy & Objects > Proxy Policy.
  4. Click Create New.
  5. Set Proxy Type to Transparent Web, set the Incoming Interface to port2, and set the Outgoing Interface to port1.
  6. Also set Source and Destination to all, Scheduleto always, Service to webproxy, and Action to ACCEPT.
  7. Configure the remaining settings as needed.
  8. No special configure is required on the client to use FortiGate transparent proxy. As the client is using the FortiGate as its default gateway, requests will first hit the regular firewall policy, and then be redirected to the transparent proxy policy.

To configure transparent proxy in the CLI:

  1. Configure a regular firewall policy with HTTP redirect:

config firewall policy edit 1 set name “1”

set uuid c5c30442-54be-51e9-c17c-4513b1c973c0

set srcintf “port2” set dstintf “port1” set srcaddr “all” set dstaddr “all” set action accept set schedule “always” set service “ALL” set inspection-mode proxy set http-policy-redirect enable

set fsso disable

set ssl-ssh-profile “deep-inspection”

set nat enable

next

end

  1. Configure a transparent proxy policy:

config firewall proxy-policy edit 5 set uuid 8fb05036-56fc-51e9-76a1-86f757d3d8dc set proxy transparent-web set srcintf “port2” set dstintf “port1” set srcaddr “all” set dstaddr “all” set service “webproxy” set action accept set schedule “always”

next end

  1. No special configure is required on the client to use FortiGate transparent proxy. As the client is using the FortiGate as its default gateway, requests will first hit the regular firewall policy, and then be redirected to the transparent proxy policy.

Explicit web proxy

Explicit web proxy

Explicit web proxy can be configured on FortiGate for proxying HTTP and HTTPS traffic.

To deploy explicit proxy, individual client browsers can be manually configured to send requests directly to the proxy, or they can be configured to download proxy configuration instructions from a Proxy Auto-Configuration (PAC) file.

Once explicit proxy is configured on an interface, the interface IP address can be used by client browsers to forward requests directly to the FortiGate. FortiGate also supports PAC file configuration

To configure explicit web proxy in the GUI:

  1. Enable and configure explicit web proxy:
    1. Go to Network > Explicit Proxy.
    2. Enable Explicit Web Proxy.
    3. Select port2 as the Listen on Interfaces and set the HTTP Port to 8080.
    4. Configure the remaining settings as needed.
    5. Click Apply.
  2. Create an explicit web proxy policy:
  3. Go to Policy & Objects > Proxy Policy.
  4. Click Create New.
  5. Set Proxy Type to Explicit Web and Outgoing Interface to port1.
  6. Also set Source and Destination to all, Schedule to always, Service to webproxy, and Action to ACCEPT.
  7. Configure a client to use the FortiGate explicit proxy:

Set the FortiGate IP address as the proxy IP address in the browser, or use an automatic configuration script for the PAC file.

To configure explicit web proxy in the CLI:

  1. Enable and configure explicit web proxy:

config web-proxy explicit set status enable set ftp-over-http enable set socks enable set http-incoming-port 8080 set ipv6-status enable set unknown-http-version best-effort

end

config system interface

edit “port2” set vdom “vdom1”

set ip 10.1.100.1 255.255.255.0

set allowaccess ping https ssh snmp http telnet set type physical set explicit-web-proxy enable set snmp-index 12

end

next

end

  1. Create an explicit web proxy policy:

config firewall proxy-policy edit 1 set uuid 722b6130-13aa-51e9-195b-c4196568d667 set proxy explicit-web set dstintf “port1” set srcaddr “all” set dstaddr “all” set service “webproxy” set action accept set schedule “always” set logtraffic all

next

end

  1. Configure a client to use the FortiGate explicit web proxy:

Set the FortiGate IP address as the proxy IP address in the browser, or use an automatic configuration script for the PAC file.

VoIP Solutions – SIP over TLS

SIP over TLS

Some SIP phones and servers can communicate using TLS to encrypt the SIP signaling traffic. To allow SIP over TLS calls to pass through the FortiGate, the encrypted signaling traffic must be unencrypted and inspected. The FortiGate SIP ALG intercepts, unencrypts , and inspects the SIP packets, which are then re-encrypted and forwarded to their destination.

The SIP ALG only supports full mode TLS. This means that the SIP traffic between SIP phones and the FortiGate, and between the FortiGate and the SIP server, is always encrypted. The highest TLS version supported by SIP ALG is TLS

1.2.

To enable SIP over TLS support, the SSL mode in the VoIP profile must be set to full. The SSL server and client certificates can be provisioned so that the FortiGate can use them to establish connections to SIP phones and servers, respectively.

To configure SIP over TLS:

  1. Configure a VoIP profile with SSL enabled:

config voip profile edit “tls” config sip set ssl-mode full set ssl-client-certificate “ssl_client_cert” set ssl-server-certificate “ssl_server_cert”

end

next

end

The ssl_server_cert, ssl_client_cert, and key files can be generated using a certification tool, such as OpenSLL, and imported to the local certificate store of the FortiGate from System > Certificates in the GUI. Existing local certificates in the certificate store can also be used. As always for TLS connections, the certificates used must be verified and trusted at the other end of the connection when required.

For example, the CA certificate of the SIP server’s certificate should be imported to the FortiGate as an external CA certification, such that the FortiGate can use it to verify the SIP server’s certificate when setting up the TLS connection. The CA certificate configured as the ssl_server_cert should be installed as the trusted certificate on the SIP phones. The deployment of the certificates across the network depends on the SIP client and server devices that are used in the system.

  1. Apply the profile to the firewall policy:

config firewall policy edit 1 set srcintf “port1” set dstintf “port2” set srcaddr “all” set dstaddr “vip_sip_server” set action accept set schedule “always” set service “SIP” set utm-status enable set voip-profile “tls”

next end