|
When FortiGate is configured as explicit proxy, it is possible to add headers such as header-x-forwarded-for and header-x-authenticated-user to HTTP traffic. To do so, the ssl-ssh-profile needs to be configured to do deep inspection. So the policy matching the HTTP traffic should have 'webproxy-profile' (which is configured to add x-headers) and ssl-ssh-profile (which is configured in deep inspection mode).
It is important to make sure that the target websites for adding the X-headers are not part of ssl-exempt, as in that case, even if the SSL inspection profile is configured with deep inspection, the websites matching the ssl-exempt address/category will be skipped.
For example:
config firewall ssl-ssh-profile
edit "ssl-deepinspection"
config ssl
set inspect-all deep-inspection
set unsupported-ssl-version allow
set untrusted-server-cert block
end
config https
end
config ssl-exempt
edit 1
set fortiguard-category 31
next
end
config web-proxy profile
edit "XFF-add"
set header-x-forwarded-for add
next
end
The policy for matching HTTP traffic:
config firewall proxy-policy
edit 1
set proxy explicit-web
set dstintf "port3"
set srcaddr "all"
set dstaddr "all"
set service "web"
set action accept
set schedule "always"
set logtraffic all
set users "localuser"
set webproxy-profile "XFF-add"
set ssl-ssh-profile "ssl-deepinspection"
next
end
In the example above, for any website that matches category 31 (Finance and Banking), the FortiGate (WAD process) will not add the X-Forwarded-For header.
To verify whether the website matches the exemption, 'Log SSL exemption' in the SSL deep inspection profile can be enabled. Additionally, WAD debug can indicate the match:
diagnose wad filter clear
diagnose wad filter src <ip address of the client you are sending http/https request from>
diagnose wad debug enable all
diagnose debug enable
Example of WAD debug:
wad_url_choose_cate :2125 cate=31 (ftgd) url-cates=[31,]; url=[ # 196,31,],ip=[ # 0,]; conf sslexempt_rating '':[87,33,31,]
wad_http_ssl_urlfilter_check :627 ssl.deep_scan=1/1/1 exempt_type=x_ftgd_cat cate-rating=0
|
