Skip to main content
Frosty
Frosty
New Member
December 16, 2014
Solved

Transparent web proxy and Exempt List in v5.0.9

  • December 16, 2014
  • 3 replies
  • 7894 views

We have an FG200B running v5.0.9 and we want to start using the Transparent Web Proxy features again (we do have an SSD in the FG200B).

I configured a Policy limited to just a couple of PCs and ticked the appropriate box.  The Monitor in the FG200B shows that the transparent proxy is working.  So far so good.

Now I want to configure an Exempt List for URLs which don't work so good with the transparent proxy. 

Nothing I can see in the GUI, so I check the FortiOS Handbook. 

It says go to "WAN Opt & Cache > Cache > Exempt List" ... except my GUI doesn't have this option.

The handbook also says use "config wanopt webcache" and then "set cache-exemption enable" ... except my CLI doesn't have this option.

Can anyone shed any light on this?  Does the FG200B simply not have this level of configuration available?  I know it used to be available back in v4.3, so was it removed for some reason?

    Best answer by Dave_Hall

    Stephen Frost wrote:

    It says go to "WAN Opt & Cache > Cache > Exempt List" ... except my GUI doesn't have this option.

    The handbook also says use "config wanopt webcache" and then "set cache-exemption enable" ... except my CLI doesn't have this option.

    Can anyone shed any light on this?  Does the FG200B simply not have this level of configuration available?  I know it used to be available back in v4.3, so was it removed for some reason?

    I think sometime around 4.3.11 time-frame, disk logging and web caching has been disabled on the 200B by default.  But I believe you can re-enable it via the CLI.  I never bothered to try web caching on 5.0.x, so didn't/don't know if it was/is available.

     

    Just shipped out my last available 200B, so not able to test web caching on that model.  On the 200D, the syntax is different than what is listed on page 84 of the CLI ref guide.

     

    config web-proxy url-match
        edit "label"
            set status enable

            set cache-exemption enable
            set url-pattern "www.example.com"
        next
    end

     

     

    3 replies

    Dave_Hall
    Dave_HallAnswer
    New Member
    December 16, 2014

    Stephen Frost wrote:

    It says go to "WAN Opt & Cache > Cache > Exempt List" ... except my GUI doesn't have this option.

    The handbook also says use "config wanopt webcache" and then "set cache-exemption enable" ... except my CLI doesn't have this option.

    Can anyone shed any light on this?  Does the FG200B simply not have this level of configuration available?  I know it used to be available back in v4.3, so was it removed for some reason?

    I think sometime around 4.3.11 time-frame, disk logging and web caching has been disabled on the 200B by default.  But I believe you can re-enable it via the CLI.  I never bothered to try web caching on 5.0.x, so didn't/don't know if it was/is available.

     

    Just shipped out my last available 200B, so not able to test web caching on that model.  On the 200D, the syntax is different than what is listed on page 84 of the CLI ref guide.

     

    config web-proxy url-match
        edit "label"
            set status enable

            set cache-exemption enable
            set url-pattern "www.example.com"
        next
    end

     

     

    Frosty
    FrostyAuthor
    New Member
    December 16, 2014

    Dave Hall wrote:
    config web-proxy url-match

    You're a gem, thanks!  I feel like a bit of an idiot, because when I went to "config web-proxy url-match" I found all my old v4.3 exemption URLs sitting there; they hadn't been lost from the configuration as I had thought:

     

    config web-proxy url-match     edit "Exempt-Site-MicrosoftNCSI-1"         set cache-exemption enable         set url-pattern "msftncsi"     next     edit "Exempt-Site-MicrosoftNCSI-2"         set cache-exemption enable         set url-pattern "ncsi.txt"     next     edit "Exempt-Site-MicrosoftSchemas"         set cache-exemption enable         set url-pattern "schemas.microsoft.com"     next     edit "Exempt-Site-MicrosoftSTO"         set cache-exemption enable         set url-pattern "microsoftsto"     next     edit "Exempt-Site-WindowsUpdate-1"         set cache-exemption enable         set url-pattern "download.windowsupdate.com"     next     edit "Exempt-Site-WindowsUpdate-2"         set cache-exemption enable         set url-pattern "download.microsoft.com"     next     edit "Exempt-Site-WindowsUpdate-3"         set cache-exemption enable         set url-pattern "www.update.microsoft.com"     next     edit "Exempt-Site-WindowsUpdate-4"         set cache-exemption enable         set url-pattern "207.46.61.90"     next     edit "Exempt-Site-YouTube"         set cache-exemption enable         set url-pattern "youtube.com"     next end

    Frosty
    FrostyAuthor
    New Member
    December 18, 2014

    Ahhhh ... found it !!! ... it IS in the GUI, just not in the place mentioned in the Fortinet documentation:

     

    VDOMs, root, System, Network, Explicit Proxy, section: URL Match List

     

    I'm not using an Explicit Proxy, so I would never have thought to look here for the transparent web caching exempt URL list.  I just happened to be clicking around and found it by accident.

     

    My "URL Match List" shows a green 'tick' under the column "Cache Exemption".  I guess I will have to find out exactly what that means ... does it mean "don't allow anything matching this to be cached" ... or something else?  I tried clicking on Help but it went to a broken URL.

    laf
    laf
    New Member
    September 3, 2015

    Hi guys,

     

    Is it possible to setup Fortigate as Transparent proxy on NAT/route mode or is this a Transparent mode Fortigate deployment?

     

    Thanks in advance!

    Terms & ConditionsAccessibility statement