FortiGate
FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.
Vbharath_FTNT
Purpose
This article explains how to add X-fowarded-for and X-forwarded-proto headers to HTTP(S) traffic towards a webserver protected by the FortiGate unit (Virtual IP).
Diagram

Expectations, Requirements
The solution below is designed to keep in mind the following prerequisites are met:
 
   1) The web server is protected by FortiGate unit and listening for requests on HTTP port 80.
 
   2) Administrator must import a valid SSL certificate (including the private key) for the webserver on to FortiGate unit for SSL offloading.
 
   3) The solution will using a Virtual IP on the FortiGate, and it will perform SSL offloading in HALF mode. See the attached diagram for SSL half mode example.

   4) The traffic between the client PC > FortiGate should be HTTPS.

   5) FortiGate unit will perform SSL offload using the certificate imported by the Administrator.

   6) Once the traffic is offloaded (decrypted) FortiGate will add the x-forwarded HTTP headers to the plain text HTTP traffic, additional UTM inspection can be also performed on the traffic.

   7) Traffic will be sent to the Webserver in the protected network in plain text HTTP.
 
Note : The load balance Virtual server (Layer 7 VIP) doesn't support x-forwarded-proto header.


Configuration
1) Use FortiGate's GUI to import the Webserver's SSL certificate.

Login to GUI > System Certificates > Import > Local Certificate

Select Type PKCS #12 certificate the certificate in PKCS format is available.

If public and private key files for the certificate are available, select Type as  “Certificate” and select the public key and private key files.

For more information, please refer to Fortinet's Knowledge Base articles:
   - Technical Note: How to split PKCS#12 Certificates into Public and Private Key files
   - Technical Note: Import a Microsoft IIS Server Certificate into FortiOS

2) Configure Virtual IP as follows:

Note : If the Virtual IP is already configured on the FortiGate unit, skip this step and proceed to step 3.
 
FortiGate unit GUI can also be used to add a Virtual IP,
"Login to GUI > Policy & Objects > Virtual IPs", however this article will use the CLI configuration example.

config firewall vip
    edit "example.com"
        set extip x.x.x.x
        set extintf "external_interface_connected_to_internet"
        set mappedip y.y.y.y
    next
end

3) Configure Web-Proxy Profile as follows:
config web-proxy profile
    edit "1"
        set header-x-forwarded-for add       <-- to add the x-forwarded-for header.
    next
end

4) Create a URL filter table as follows:
config webfilter urlfilte
    edit 1
        set name "example.com"
        config entries
        edit 1
            set url www.example.com
            set action monitor
            set web-proxy-profile "1"      <-- webproxy profile configured in step 3
        next
    end
    next
end

Note : This should match the hostname used by clients on the Internet.

If there are multiple host names used by the webserver, multiple entries need to be added. The web-proxy profile must be set for each URL entry.

5) Create a webfilter profile and select the URL filter table in webfilter profile as follows:

config webfilter profile
    edit "example.com"
        config web
        set urlfilter-table 1
    end
end

6) SSL-server configuration as follows:
config firewall ssl-server
    edit "example.com"
        set ip y.y.y.y
        set ssl-mode half
        set url-rewrite enable
        set add-header-x-forwarded-proto enable        <-- enabled by default
        set ssl-cert "example.com"
    next
end

7) Configure the SSL-SSH Profile as follows:
config firewall ssl-ssh-profile
    edit "example.com"
        set server-cert-mode re-sign
        set use-ssl-server enable
    next
end

8) Configure firewall policy as follows:
config firewall policy
    edit <id>
        set srcintf "external_interface_connected_to_internet"
        set dstintf "interface_connected_to_webserver"
        set srcaddr "all"
        set dstaddr "example.com"                   <-- VIP created in step 2
        set action accept
        set schedule "always"
        set service "ALL"
        set utm-status enable
        set webfilter-profile "example.com"         <-- webfilter profile created in step 5
        set profile-protocol-options "default"
        set ssl-ssh-profile "example.com"           <-- ssl-ssh profile in step 7
    next
end


Verification

HTTP request on received on the server:

GET / HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134
Accept-Language: en-US
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Upgrade-Insecure-Requests: 1
Accept-Encoding: gzip, deflate, br
Host: example.com
Connection: Keep-Alive
X-Forwarded-Proto: https
X-Forwarded-For: 200.200.12.54


Related Articles

Technical Note: How to split PKCS#12 Certificates into Public and Private Key files

Technical Note: Import a Microsoft IIS Server Certificate into FortiOS

Contributors