WAF topology with fortiweb

[AdriBall]

Hello and thanks in advance.

I need an advice related fortiweb topology, can we implement ssl certificate only on fortiweb and allow communication between the end-user browser with https and next segment with HTTP only?

External client web browser <- HTTPS -> FortiWeb appliance <- HTTP -> DMZ webserver

thanks

[jwhite_FTNT]

Yes, this is option is often referred to as "SSL Offloading".  You can determine the back end communication type (HTTP or HTTPS) when you define the servers within the protected server pool.

[AdriBall]

thank you Jim.

[ocarper_FTNT · Accepted solution]

Hi Adriatik,

Yes it's possible to implement the configuration you mentioned, in which the FortiWeb can offload the SSL encryption/decryption to the web servers. This is only supported when the FortiWeb is deployed as reverse proxy  and thus it can act as the SSL/TLS terminator. Just keep in mind that the FortiWeb will need a copy of your web server's certificate.

You may find more info and examples in: 

http://help.fortinet.com/fweb/586/index.htm#FortiWeb/fortiweb-admin/offloading_vs.htm%3FTocPath%3DSecure%2520connections%2520(SSL%252FTLS)%7C_____1

http://help.fortinet.com/fweb/586/index.htm#FortiWeb/fortiweb-admin/offload_https.htm%3FTocPath%3DSecure%2520connections%2520(SSL%252FTLS)%7C_____4

Regards

[AdriBall]

Thank you, Octavio,

This is what I was thinking about reverse proxies in general.

I did some tests that obviously failed because I used Fortinet_factory certificate.

seems that i have to have a proper ssl cert for that test.

thanks

adriatik
In Reply to Octavio Carranza:

Hi Adriatik,

Yes it's possible to implement the configuration you mentioned, in which the FortiWeb can offload the SSL encryption/decryption to the web servers. This is only supported when the FortiWeb is deployed as reverse proxy  and thus it can act as the SSL/TLS terminator. Just keep in mind that the FortiWeb will need a copy of your web server's certificate.

You may find more info and examples in: 

http://help.fortinet.com/fweb/586/index.htm#FortiWeb/fortiweb-admin/offloading_vs.htm%3FTocPath%3DSecure%2520connections%2520(SSL%252FTLS)%7C_____1

http://help.fortinet.com/fweb/586/index.htm#FortiWeb/fortiweb-admin/offload_https.htm%3FTocPath%3DSecure%2520connections%2520(SSL%252FTLS)%7C_____4

Regards

[rmoussa]

Installing the fortinet factory certificate on the end-user browser can work for testing.

In a real environment you need a public CA

Rony Moussa

NSE Certified : Level 8

[AdriBall]

yes, it works with that one too.

I can confirm with my tests. 

thanks

 Rony

 
In Reply to Rony Charbel Moussa:

Installing the fortinet factory certificate on the end-user browser can work for testing.

In a real environment you need a public CA

Rony Moussa

NSE Certified : Level 8

[#8]

Offcourse you are doing right but Facilitating on AWS is a quick and disentangled strategy to convey and oversee electronic applications. However these applications still should be secured similarly as though they were sitting in an on-introduce server farm. Regardless of whether to just meet consistence gauges or to ensure mission basic facilitated applications,

Essay Writers

[rebehick]

Actually this is one of the most exciting games. And the site also has many different types of games you can play and feel. Thank you very much for visiting my website and wish you success. Thank you so much!
 |=>bloons tower defense 5 super smash flash 2