Skip to main content
SeanM
SeanM
New Member
August 30, 2015
Question

Forigate 300D - Reverse Proxy Questions

  • August 30, 2015
  • 3 replies
  • 8313 views

Hi all,

 

We are looking into the Forigate 300D as a replacement for our internal TMG.

 

We know that the 300D can cover most of the functionality we need, but we are unsure if it can cover the reverse proxy requirements.

 

We publish Exchange and ADFS through TMG, is there a way we can publish these service with the Fortigate instead?

 

Thank you

Sean

    3 replies

    dpar
    dpar
    New Member
    August 31, 2015

    Hi,

     

    It can be done! Use (Server) "Load Balance" feature, with one real server to "balance".

     

    Dimitris

    vjoshi_FTNT
    Staff
    vjoshi_FTNT
    Staff
    August 31, 2015

    Hello,

     

    Yes, Fortigate does it, but depends on the configuration.

     

    If it is a generic VIP, only the Destination NAT happens, if it involves SSL inspection or load balancing(in Virtual Server), it does reverse proxy.

    hklb
    hklb
    Visitor III
    April 9, 2016

    Hi,

     

    How can we check if the reverse proxy is done ?

     

    I configured my VIP like that :

    config firewall vip

    edit "www"         set type server-load-balance         set extip x.x.x.x         set extintf "wan1"         set server-type http         set extport 80             config realservers                 edit 1                     set ip 10.9.0.13                     set port 80                 next             end     nextend

     

    config firewall policy     edit 11         set srcintf "WAN"         set dstintf "LAN"         set srcaddr "all"         set dstaddr "www" "vdoc"         set action accept         set schedule "always"         set service "HTTP"         set utm-status enable         set av-profile "AV_SRV"         set ips-sensor "IPSServer"         set profile-protocol-options "ReverseProxy"         set ssl-ssh-profile "certificate-inspection"     next end config antivirus profile     edit "AV_SRV"         set inspection-mode proxy             config http                 set options scan             end     next end config firewall profile-protocol-options     edit "ReverseProxy"             config http                 set ports 80                 set options clientcomfort                 set comfort-amount 5                 unset post-lang             end     next end

     

    Thanks !

     

    Lucas

    Terms & ConditionsAccessibility statement