FortiWEB design

Forum|Forum|11 months ago
June 18, 2025
2 replies
1598 views

Dears,

I come from an F5 background and have one key question: how can we deploy FortiWeb in a one-arm in reverse proxy mode, and how can we enable source NAT to avoid asymmetric routing issues as Fortweb will not the gateway of the application server, or will not in inline between the public and App server

FortiWEB

atakannatak

Explorer

Hi @amr_ali1 ,

Deploy FortiWeb on a single interface / VLAN in a DMZ and use the upstream firewall (FortiGate, router, or etc.) to DNAT only HTTP/HTTPS traffic to FortiWeb’s virtual-server IP. FortiWeb then proxies the request to the real server, using its own interface IP as the source, so replies automatically return through the WAF—no extra routing tricks are needed. Keep the firewall configured to block all direct access to the back-end server IPs; otherwise a savvy client could bypass the WAF, a risk Fortinet highlights for one-arm topologies

Because the server now sees FortiWeb’s IP, enable X-Forwarded-For so FortiWeb adds the real client address to an HTTP header; most web servers can log or trust that header. FortiWeb can also use the same header for its own enforcement and logging, keeping security events tied to the true user IP.

In short: forward only web ports to FortiWeb, let its built-in SNAT keep the path symmetric, insert an X-Forwarded-For header so the application still knows who the client is, and rely on the firewall to prevent any protocol or port that shouldn’t touch the servers from sneaking around the WAF.

NOTE: Fortinet’s own documentation stresses that you must rely on an upstream firewall to steer only web traffic to FortiWeb and block every bypass path. For environments that can’t tolerate those caveats, Fortinet recommends switching to a multi-arm (inline) design instead.

https://docs.fortinet.com/document/fortiweb/7.6.4/administration-guide/211763/planning-the-network-topology#planning_topology_3148766757_1029218

BR.

If my answer provided a solution for you, please mark the reply as solved it so that others can get it easily while searching for similar scenarios.

CCIE #68781

amr_ali1Author

New Member

Dear @atakannatak

Thank you very much for clarifying these points. I just have one more question: how can I configure FortiWeb to perform source NAT? I'm specifically referring to the steps required to apply source NAT within the system

atakannatak

Explorer

Hi @amr_ali1 ,

Nothing extra—SNAT is automatic; FortiWeb already uses its own interface IP when it proxies the request to the back-end. If you need FortiWeb to use a different source IP, consult the three official guides below: first enable the Firewall feature, then create an SNAT policy that specifies the address FortiWeb should use when forwarding traffic.

https://docs.fortinet.com/document/fortiweb/7.4.2/cli-reference/689359/system-feature-visibility

https://docs.fortinet.com/document/fortiweb/7.4.1/cli-reference/296078/system-firewall-snat-policy

https://docs.fortinet.com/document/fortiweb/7.6.4/administration-guide/238735/network-address-translation-nat

BR.

If my answer provided a solution for you, please mark the reply as solved it so that others can get it easily while searching for similar scenarios.

CCIE #68781

DaisyJade

New Member

If you’re deploying FortiWeb in one-arm reverse proxy mode, you’ll need to enable source NAT so the return traffic flows back through FortiWeb, avoiding asymmetric routing. In this setup, FortiWeb translates the client IP to its own before forwarding to the backend, ensuring responses always return through it even though it isn’t the default gateway.

Just like with these website design services, where the architecture and flow must be planned carefully to avoid conflicts, proper NAT configuration is key to keeping the traffic path clean and consistent.