Technical Tip: Unable to use http-redirect option under virtual server configuration when NGFW policy-mode enabled

As a primer, the http-redirect option can be configured for HTTP Virtual Server objects (aka Virtual IPs of type server-load-balance) and allows the FortiGate to redirect client requests from HTTP to encrypted HTTPS (see also: HTTP to HTTPS redirect for load balancing).

However, while this option can be utilized for FortiGates/VDOMs operating in NGFW profile-based mode, it is not available when using NGFW policy-based mode:

FortiGate # config firewall vip
FortiGate (vip) # show
config firewall vip

    edit 'Test-443'

        set type server-load-balance
        set extip 10.1.1.1
        set extintf 'Internal'
        set server-type https
        set monitor 'Test-HTTPS'
        set ldb-method round-robin
        set extport 443
            config realservers

                edit 1

                    set ip 10.2.2.2
                    set port 443

                next
                edit 2

                    set ip 10.3.3.3
                    set port 443

                next

            end

    next

FortiGate (vip) # edit Test-443
FortiGate (Test-443) # set http-redirect enable
command parse error before 'http-redirect'
Command fail. Return code -61

The reason this occurs is because the http-redirect option is a proxy-based feature (i.e., traffic is redirected the the WAD-based proxy). Since NGFW is a purely flow-based mode of operation (e.g., using the IPS Engine), it is not possible to utilize the http-redirect function, and so it is unavailable to be configured.

Several other proxy-based config options are also unavailable when using Virtual Servers in NGFW policy-mode, including http-ip-header, h3-support, h2-support, persistence, and http-multiplex. Consider using NGFW profile-based mode instead if proxy-based Virtual Server functions are required.