Configuring HTTP header to allow "youtube for education"

[Mbutler522010]

Youtube now has a solution to allow only the education side. The solution is to add an HTTP header.

https://support.google.com/youtube/answer/2695317?hl=en

I searched for HTTP Header in the FortiOS documentation and it pointed me at "Proxy Header Control": http://help.fortinet.com/fos50hlp/52/index.html#page/FortiOS%25205.2%2520Help/wanopt.016.4.html

Unfortunately it doesn't mention the impact of any of this (will it screw up existing traffic?) and the options are confusing ( 5 different kinds of headers, none of which match the language in the google page)

We currently do not have anything like that defined, has anyone set this up? Of course there isn't anything in the GUI named "Proxy Header Control"  Do I set that up in "Explicit proxy" or "Proxy Options" GUI or do I have to do it in the CLI?

[MrN3ff]

Were you able to resolve this?

[Mbutler522010]

not yet. I opened a ticket on it and was told we needed to implement proxy. So I have spent the last couple of months working out enabling proxy with AD integration. Once we had it set up, I opened another ticket and was told we didn't need a proxy....sigh. The issue is that it cannot be done from the GUI.

I was told to do (Ticket Number:  1693602)

config web-proxy profile edit "test-profile" config headers edit 1 set name "X-YouTube-Edu-Filter" set content "ABCD1234567890abcdef" end end Finally configure the Explicit Proxy policy that is allowing the traffic to Youtube to use the just created web-proxy profile: config firewall explicit-proxy-policy edit 1 <- ID of the explicit proxy policy set webproxy-profile "test-profile" end end However that did not work so after more research, he said the problem is that "we used certificate inspection.  I researched this further and we needed to use the deep inspection default " and this is where we are now. I am reluctant to use deep-inspection because it changes the way certificates are handled and usually gives certificate errors on every website. I have to admit, I am pretty dissapointed in Fortinet. Their flagship firewall product seems really old-school and barely able to handle common issues such as this. Having to manually code something as universal as safe-search or google issues implies they are not keeping up with how the internet is evolving. We also have a similar issue around google safesearch. It requires a forced URL change. The recommended solution is to modify DNS but that causes a whole host of problems around split-horizon foreign domains so I need to try and get the fortigate to do it.

I am not confident.

[Mbutler522010]

update... we successfully were able to make this work.

however....two major hurdles exist.

1) "deep-inspection" of certificates IS required, which means either the Fortigate certificate must be installed on all workstations, or a trusted certificate must be installed on the Fortigate - we are still trying to get this to work.

2) the bigger problem. The GUI is incompatible with the configuration and every time the GUI is used to change any profiles (such as adding a category to exclude, or allowing a website to have access) then the configuration must be manually reprogrammed in the CLI. THis makes it so unweildy that it may not be worth doing. See my last paragraph of the previous entry.

[ede_pfau]

I'm surprised that FortiOS provides for header rewrites - this is not something that you'd expect a normal firewall to do. Rather, a web firewall like the FortiWeb will do it out of the box but this is a dedicated device to control and manipulate HTTP traffic, not so easy to set up and quite expensive. A clear overkill for just YTfE.

Have you thought about redirecting the HTTP traffic out of the FGT to a dedicated (proxy) server via ICAP or WCCP? Both are supported in FortiOS. I admit the prospect of maintaining an additional server for one purpose alone is not promising but it might be an alternative.

[Alizaa2]

---

@Mbutler522010 wrote:

Youtube now has a solution to allow only the education side. The solution is to add an HTTP header.

https://support.google.com/youtube/answer/2695317?hl=en

I searched for HTTP Header in the FortiOS documentation and it pointed me at "Proxy Header Control": http://help.fortinet.com/fos50hlp/52/index.html#page/FortiOS%25205.2%2520Help/wanopt.016.4.html

Unfortunately it doesn't mention the impact of any of this (will it screw up existing traffic?) and the options are confusing ( 5 different kinds of headers, none of which match the language in the google page)

We currently do not have anything like that defined, has anyone set this up? Of course there isn't anything in the GUI named "Proxy Header Control"  Do I set that up in "Explicit proxy" or "Proxy Options" GUI or do I have to do it in the CLI?

---

To configure the HTTP header to allow "YouTube for Education" on FortiOS, you need to follow the steps to add the required HTTP header through the FortiGate firewall settings. This setup can be done either via the GUI or the CLI. Here’s a step-by-step guide:

Via CLI

1. Log in to FortiGate CLI: Access your FortiGate device using SSH or the console.

2. Enter Configuration Mode:

   shell

   config web-proxy global

3. Set the required HTTP header:

   shell

   set forward-header "X-YouTube-Edu-Filter" set forward-header-value "your-school-id"

   Replace "your-school-id" with the unique identifier provided by YouTube for your educational institution.

4. Save the Configuration:

   shell

   end

Via GUI

1. Log in to FortiGate GUI: Access your FortiGate device using your web browser.
2. Navigate to Explicit Proxy: Go to Network > Explicit Proxy.
3. Configure the Proxy Options:
   • If "Proxy Options" is not directly visible, you might need to enable it under System > Feature Visibility.
4. Add HTTP Header:
   • Look for settings related to HTTP headers in the proxy options.
   • Add a new header with the name X-YouTube-Edu-Filter and the value as your school’s unique identifier.

Confirming Impact on Traffic

To ensure that adding this header does not disrupt existing traffic:

1. Testing Environment: First, apply the configuration in a testing environment or during a maintenance window.
2. Monitor Traffic: Use FortiGate’s monitoring tools to observe any changes in traffic behavior.
3. Rollback Plan: Have a rollback plan ready if any issues arise.

Documentation and Support

• Fortinet Documentation: Refer to the FortiOS documentation for any additional details or updates.
• Google Support: Check the latest information from the Google Support page for "YouTube for Education".
• Fortinet Support: If you encounter any issues or need further assistance, contact Fortinet support for guidance specific to your setup.

By carefully following these steps and monitoring the impact, you can configure the HTTP header to allow access to "YouTube for Education" like tutor online pakistan without disrupting existing network traffic.