New Member

Solved

HTTP to HTTPS redirect

Forum|Forum|11 years ago
September 28, 2014
6 replies
64845 views

Good day to everyone! I faced a real problem with publishing sites with my Fortigate 100D. I have a web-server that published with http port 80. I need to redirect all http trafic to https. We are migrating from Forefront TMG and there I could do this by adding aditional listener on the 443 port and redirecting whole traffic to it. Can I do this with Fortigate 100D? Well actually there is no problem with publishing 80 port by VIPs but I have no idea how to redirect it.. I' ve tried everything but it doesn' t works... Please, help me!

Best answer by DW_FTNT

HTTP to HTTPS redirect was added to 6.2.1 Code you can terminate 443 on the fortigate or just pass 443 all the way to the server. This link shows how to terminate/offload 443 on the fortigate https://docs.fortinet.com/document/fortigate/6.2.0/cookbook/304594/http-to-https-redirect-for-load-balancing here is a link to offloading https://help.fortinet.com/fos50hlp/54/Content/FortiOS/fortigate-load-balancing-52/ldb-ssl-tls-offload.htm if you want to just pass 443 to the server and not terminate the session on the fortigate

edit the vip

"virtual-server-https" ---> set server-type tcp

we can redirect other ports like 8080

using http

edit "virtual-server-http"

set extport 80

to

set extport 8080

be sure to use proxy mode

emnoc

New Member

Can' t you just create to vips or port-forward for 80 & 443? So when the client initially connects to http://x.x.x.x:80 and get' s the 3XX redirection, h automatically connects at https://x.x.x.x:443 or whatever port in the redirection. Just ensure you craft your firewall-policies for the correct service/ports for the VIP.

ejhardin

New Member

The web server would have to do the redirect as the fortigate is not able to switch protocols. It will open ports but will not move traffic from one protocol to another. You need a FortiWeb or have the web server issue a redirect.

PavelAuthor

New Member

Thanks for your feedback! Now I see, my Fortigate just don' t have ssl acceleration... So sad. Wiil try to resolve it somehow. Anyway thanks again!

Istvan_Takacs_FTNT

Staff

What do you mean ' no ssl acceleration' ? The 100D comes with a CP8 ASIC that does SSL processing. Suggest to run the following commands to double-check; get hardware status Model name: FortiGate-100D ASIC version: CP8 ........ get vpn status ssl hw-acceleration-status But as previously was mentioned what you want to achieve has nothing to do with Fortigate SSL acceleration. What you need is a simple VIP object that delivers the port 80 connection requests to port 443 on your web server. e.g show firewall vip edit " vip-web-server_HTTPS" set extip <public IP of the web server> set extintf " WAN1" set portforward enable set mappedip <private IP of the web server> set extport 80 set mappedport 443 next

AndreaSoliva

New Member

Hi I suggest following. Go to your FortiGate Support Account and/or Partner Account. Look and/or Search for following document: How to configure TMG features on FortiGate There is a FortiGate document which explains how to transfer this stuff of configuration. What you like to to is actually a reverse proxy on a fortigate. On such configuration is possible to have outside https teriminating on FGT and FGT does SSL offloading and forward the traffic to the server by http etc. Also ActivSynch implementation are step by step explaind. Have a try hope this helps have fun Andrea

Christopher_McMullan

Staff

It sounds like the initial connection needs to be made over port 80 and connect to the server on port 443, not the reverse. My knowledge usually only expands through training, helping others with their tickets, or when someone calls in because something is wrong (no one calls in when everything works!) All that being said, a VIP used as a virtual server for a reverse proxy can be set with ssl-mode full or half. Full encrypts both legs (client > FortiGate and FortiGate > server). Half encrypts the client > FortiGate portion. In both cases, unless I' m missing something, you still need the client to target port 443 on the FortiGate. Please feel free to pile on if there are exceptions. The CLI reference for OS 5.0 details this under ' config firewall vip' on page 228.

PavelAuthor

New Member

Huge thanks for your feedback!!! All your posts were helpfull! The problem was with firmware (I have a virtual WAN with 3 physical caonnections from 2 IPS). After upgrading to v 5.2.1 ssl offloading started to work fine. And then Cristopher McMullans post helped me with ssl-http-location conversion! So thanx to you all guys! And sorry for late reply!

DW_FTNT

Staff

HTTP to HTTPS redirect was added to 6.2.1 Code

you can terminate 443 on the fortigate or just pass 443 all the way to the server.

This link shows how to terminate/offload 443 on the fortigate

https://docs.fortinet.com/document/fortigate/6.2.0/cookbook/304594/http-to-https-redirect-for-load-balancing

here is a link to offloading

https://help.fortinet.com/fos50hlp/54/Content/FortiOS/fortigate-load-balancing-52/ldb-ssl-tls-offload.htm

if you want to just pass 443 to the server and not terminate the session on the fortigate

edit the vip

"virtual-server-https"

---> set server-type tcp

we can redirect other ports like 8080 using http

edit "virtual-server-http"

set extport 80

to

set extport 8080

be sure to use proxy mode

DW_FTNTAnswer

Staff

HTTP to HTTPS redirect was added to 6.2.1 Code you can terminate 443 on the fortigate or just pass 443 all the way to the server. This link shows how to terminate/offload 443 on the fortigate https://docs.fortinet.com/document/fortigate/6.2.0/cookbook/304594/http-to-https-redirect-for-load-balancing here is a link to offloading https://help.fortinet.com/fos50hlp/54/Content/FortiOS/fortigate-load-balancing-52/ldb-ssl-tls-offload.htm if you want to just pass 443 to the server and not terminate the session on the fortigate

edit the vip

"virtual-server-https" ---> set server-type tcp

we can redirect other ports like 8080

using http

edit "virtual-server-http"

set extport 80

to

set extport 8080

be sure to use proxy mode

pkley

New Member

I tried with the help of tech support to accomplish this and couldn't get it to work. I'm not doing load balancing, just redirect. DW_FTNT can you explain further? The guide suggests setting to http not TCP. Further I don't understand the rest of your post.

Sign up

Login with SSO

Login to the community

Login with SSO

Scanning file for viruses.

This file cannot be downloaded