FortiWeb
A FortiWeb can be configured to join a Security Fabric through the root or downstream FortiGate.
faical
Staff
Staff
Article Id 345016
Description

The article explains how to send the original IP coming from a Proxy (with Proxy Protocol) to a backend server that does not support Proxy protocol while using Fortiweb.

Scope

FortiWeb.

Solution
  1. Enable Proxy protocol on Server policy on FortiWeb:

  

Enable_proxy_protocol.png

 

Note:

'use-proxy-protocol-addr' should be kept enabled as per default settings:

 

config server-policy policy

    edit "Policy1"

        set use-proxy-protocol-addr enable

  1. Configure X-Forwarded-Rule to send the original IP (that FortiWeb parsed from incoming Proxy Protocol) to the backend server that only supports X-Forwarded-For to extract the original IP:

 

enable_XFF.png
Contributors