Description
This article describes how to configure Web Filter authentication user for local categories overrides.
Web Filter authentication is required for branch-office users to access to internal sites of a private domain.
Scope
FortiGate, Web Filter, User Authentication.
Solution
In this scenario:
- Internal Web Services are located in the Data Center. (e.g. https://intranet.fortilabmx.net).
- There is an IPsec VPN Tunnel between FGT_Datacenter and FGT_Branch.
- Internal URLs are resolved with DNS or 'host' file with private addressing. (e. g. 192.168.x.x).
- Local category override is needed.
- Web Authentication user is required to reach Internal Web Services. For this exercise, a Local user group will be used.
Local Category:
In FGT_Branch create a new web Custom Category and override internal URLs.
- To create a Custom Category: go to Security Profiles -> Web Rating Overrides -> Custom Categories -> Create New ->Name, 'Internal Sites' then select OK.
- To create a Web Rating Override: go to Security Profiles -> Web Rating Overrides -> Create New.
- URL: 'intranet.fortilabmx.net', Category: 'Custom Categories', Sub-category: 'Internal Sites', then select OK.
Important Note:
Captive portal uses temporary TCP ports for web authentication. The internal URLs must use standard web ports for HTTP/HTTPS, otherwise authentication port must be changed..
Technical Tip: How to allow custom port when non-standard port is used while active authentication
Web Filter Profile:
In FGT_Branch, create a new Web Filter profile and configure user authentication for the local category 'Internal Sites'.
- Go to Security Profiles -> Web Filter -> Create New -> Name, FortiGuard Category Based Filter -> Local Categories select 'Internal Sites'-> then Authenticate.
- Select User Groups, and define the time range for warning intervals in hours, minutes, and/or seconds. Select OK.
Remember to select OK on the next screen to save the Web Filter Profile.
Firewall Policy:
Create a firewall policy as follows:
- Name: Internal Sites.
- Incoming Interface: LAN.
- Outgoing Interface: IPSec_VPN_Interface.
- Source: all.
- Destination: all.
- Service: all.
- Inspection mode: Proxy.
- Web Filter: Web Filter.
- SSL Inspection: Certificate Inspection.
Results:
When a web browser tries to reach an internal URL, Web Authentication will prompted. After successful authentication, the Web page must be displayed as well.
Related articles:
Technical Tip: Creating a Web Filter profile with user authentication
Video: Flow Mode Webfilter Support (Warning/Authenticate/Override).
