FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.
Article Id 198187



This article describes how to configure web proxy forwarding servers to use proxy chaining.

For the explicit web proxy, you can configure web proxy forwarding servers to use proxy chaining to redirect web proxy sessions to other proxy servers.
Proxy chaining can be used to forward web proxy sessions from the FortiGate to one or more other proxy servers on the network or on a remote network.

It is possible to use proxy chaining to integrate the FortiGate explicit web proxy with a web proxy solution that already have in place.

A FortiGate can forward sessions to most web proxy servers including a remote FortiGate with the explicit web proxy enabled.
No special configuration of the explicit web proxy on the remote FortiGate is required.

It is possible to deploy the explicit web proxy with proxy chaining in an enterprise environment consisting of small satellite offices and a main office.
If each office has a FortiGate, users at each of the satellite offices can use their local FortiGate as an explicit web proxy server.

The satellite office FortiGate can forward explicit web proxy sessions to an explicit web proxy server at the central office.
From here the sessions can connect to web servers on the Internet.

FortiGate proxy chaining does not support web proxies in the proxy chain authenticating each other.

Related document.






To add a forwarding server, select 'Create New' in the Web Proxy Forwarding Servers section of the Explicit Proxy page by going to Network -> Explicit Proxy.

Example configuration of a web proxy forwarding server named fwd-srv at address and port 8080.


To configure the web proxy forwarding server via CLI:

# config web-proxy forward-server
    edit fwd-srv
        set addr-type fqdn
        set fqdn
        set port 8080

Then add explicit web proxy forwarding server in the proxy policy:

This security policy allows all users on the internal subnet to use the explicit web proxy for connections through the PORT1 interface to the Internet.
The policy forwards web proxy sessions to a remote forwarding server named fwd-srv.

To add the explicit web proxy forwarding server via CLI:
# config firewall proxy-policy
    edit 1
        set name "example"
        set proxy explicit-web
        set dstintf "port1"
        set srcaddr "internal subnet"
        set dstaddr "all"
        set service "webproxy"
        set action accept
        set schedule "always"
        set logtraffic all
        set webproxy-forward-server "fwd-srv"

Note: By default, in explicit proxy-chain setup, FortiGate as child-proxy will perform DNS lookup for the intercepted client HTTP requests. If, for any reason, DNS resolution is not possible, there is the option to configure the FortiGate to exempt the URL from DNS lookup.

This is done under the Explicit Proxy configuration using URL Match:


Screenshot 2024-04-05 111604.png

The configuration should look like this:

Screenshot 2024-04-05 112018.png


In this example all traffic will be exempted. If more granularity is needed, specific URLs can be added.