Technical Tip: How to configure a transparent proxy with FSSO

[kiri]

Description	This article explains how to configure a FortiGate as a transparent proxy with passive FSSO authentication.
Scope	FortiOS v6.x, v7.x.
Solution	Configure the FSSO connector:   config user fsso     edit "10.5.23.153"         set server "10.5.23.153"         set password Someth1ngSuperSecret     next end Configure the FSSO group with GUI or CLI: config user group     edit "FSSO-group"         set group-type fsso-service         set member "BOGUSINC/ADMINISTRATORS"     next end Configure the firewall policy: config firewall policy     edit 1         set name "fsso-trans"         set srcintf "port2"         set dstintf "port1"         set action accept         set srcaddr "all"         set dstaddr "all"         set schedule "always"         set service "ALL"         set inspection-mode proxy         set http-policy-redirect enable         set ssl-ssh-profile "deep-inspection"         set nat enable     next end Configure the proxy policy: config firewall proxy-policy     edit 1         set name "fsso-transp"         set proxy transparent-web         set srcintf "port2"         set dstintf "port1"         set srcaddr "all"         set dstaddr "all"         set service "webproxy"         set action accept         set schedule "always"         set groups "FSSO-group"     next end Configure the FSSO authentication rule and scheme: config authentication rule     edit "fsso-rule"         set srcaddr "all"         set sso-auth-method "fsso-scheme"     next end config authentication scheme     edit "fsso-scheme"         set method fsso     next end Download and import Fortinet_CA_SSL (or the CA certificate, if configured) into the end user's CA certificate store to avoid SSL errors caused by the deep inspection: Related articles: Technical Tip: Configuring explicit web proxy with FSSO Troubleshooting Tip: FortiGate transparent web-proxy and certificate errors Technical Tip: Transparent web proxy forwarding