Technical Tip: Web proxy forwarding server config between two FortiGates for internet access

In this example, the network design is as follows:

Internal network (10.151.0.0/20) ----- Port1 --- FortiGate-1 --- port3 ======= port1 --- FortiGate-2 --- (Proxy-Forwarder)---- port7 ---- Internet.

Note: The internet-facing interface on FortiGate-1 is port7.

For testing, the user with IP address 10.151.6.48 tries to browse some websites. Traffic from the client reaches port1 on FortiGate-1 and is forwarded out via the interface port3 10.135.5.107 (instead of port7 which is internet facing interface) due to the web proxy forwarder toward IP 10.135.5.108, which is the IP address of port1 on FortiGate-2, and FortiGate-2 forwards the traffic via the internet-facing interface port7 toward the internet.

Configs on FortiGate-1:

config system interface
    edit "port1"
        set ip 10.151.5.107 255.255.240.0
        set explicit-web-proxy enable
    next
    edit "port3"
        set ip 10.135.5.107 255.255.240.0
    next
    edit "port7"
        set ip 10.109.21.107 255.255.240.0
    next
end

config web-proxy explicit
    set status enable
    set http-incoming-port 8080
    set https-incoming-port 8080
    set unknown-http-version best-effort
end

config web-proxy forward-server
    edit "proxy.forward.server"
        set ip 10.135.5.108  <---- IP of interface on FortiGate-2.
        set port 8080
    next
end

config firewall proxy-policy
    edit 1
        set proxy explicit-web
        set dstintf port7
        set srcaddr "all"
        set dstaddr "all"
        set service "webproxy"
        set action accept
        set schedule "always"
        set webproxy-forward-server "proxy.forward.server"
    next
end

FGT1 # get router info routing-table all

Codes: K - kernel, C - connected, S - static, R - RIP, B - BGP
        O - OSPF, IA - OSPF inter area
        N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
        E1 - OSPF external type 1, E2 - OSPF external type 2
        i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area
        V - BGP VPNv4
        * - candidate default

Routing table for VRF=0
S*     0.0.0.0/0 [10/0] via 10.109.31.254, port7, [1/0]
C      10.109.16.0/20 is directly connected, port7
C      10.135.0.0/20 is directly connected, port3
C      10.151.0.0/20 is directly connected, port1

Configs on FortiGate-2:

config web-proxy explicit
    set status enable
    set http-incoming-port 8080
    set https-incoming-port 8080   

end

config system interface
    edit "port1"

        set vdom "root"
        set ip 10.135.5.108 255.255.240.0
        set explicit-web-proxy enable
    next
    edit "port7"
        set vdom "root"
        set ip 10.109.21.108 255.255.240.0
end

config firewall proxy-policy
    edit 1
        set name "explicit.proxy"
        set proxy explicit-web
        set dstintf "port7"
        set srcaddr "all"
        set dstaddr "all"
        set service "webproxy"
        set action accept
        set schedule "always"
    next

end

FGT2 # get router info routing-table all

Codes: K - kernel, C - connected, S - static, R - RIP, B - BGP
        O - OSPF, IA - OSPF inter area
        N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
        E1 - OSPF external type 1, E2 - OSPF external type 2
        i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area
        V - BGP VPNv4
        * - candidate default

Routing table for VRF=0
S*     0.0.0.0/0 [10/0] via 10.109.31.254, port7, [1/0]
C      10.109.16.0/20 is directly connected, port7
C      10.135.0.0/20 is directly connected, port1

Here is a sample web log that shows traffic comes from FortiGate-1 10.135.5.107  and reach internet via port7 on FortiGate-2:

date=2026-01-21 time=16:45:40 eventtime=1769010340527303236 tz="+0100" logid="0000000010" type="traffic" subtype="forward" level="notice" vd="root" srcip=10.135.5.107 srcport=1176 srcintf="port1" srcintfrole="undefined" dstcountry="United States" srccountry="Reserved" dstip=151.101.195.5 dstport=443 dstintf="port7" dstintfrole="undefined" sessionid=1123196796 service="HTTPS" proxyapptype="web-proxy" proto=6 action="accept" policyid=1 policytype="proxy-policy" poluuid="d16f7724-9a00-51f0-47ed-4b159c684c62" policyname="explicit.proxy" trandisp="snat" transip=10.109.21.108 transport=12290 appcat="unscanned" duration=1754 wanin=6990 rcvdbyte=6990 wanout=7302 lanin=7524 sentbyte=7524 lanout=7062

Related article:

Technical Tip: How to configure web proxy forwarding server (proxy chaining)