Hello there,
I'm trying to configure Explicit Proxy on my Fortigate 500E with FortiOS 6.0.5 and no luck so far.
My Fortigate is linked to my fortianalyzer and I just want to log every http/https traffic without any deep inspection SSL.
I followed multiple tutorials that we can found online and everything is pretty working well when we are using a PAC file (and add it to our web browsers configuration).
However, I want to make my last step and make it works transparently.
It seems to work well with HTTP website. When I call it, my kerberos ticket is created on my workstation and when I go on my firewall user monitor I can see my user logged with attribute Explicit + Firewall.
But if I browse an HTTPS website, I always have a certificate SSL error (and I don't want to import my fortigate SSL certificat into all my workstations).
I don't understand why it works well when proxy information is added to the web browser and with the same "filtering option" in transparent, it works with http site but not HTTPS.
Any tips for me ?
here my configuration:
config authentication setting
set active-auth-scheme "Kerberos"
set captive-portal "WEBPROXY_PORTAL"
set captive-portal-port 9666
end
config authentication scheme
edit "Kerberos"
set method negotiate
set kerberos-keytab "http_service"
next
end
config authentication rule
edit "WINRDM_Kerberos"
set srcaddr "HOST_WINRDM"
set ip-based disable
set active-auth-method "Kerberos"
set web-auth-cookie enable
next
end
config firewall profile-protocol-options
edit "RDM_PROXY"
set oversize-log enable
config http
set ports 80 8080
unset options
set http-policy enable
unset post-lang
end
config ftp
set ports 21
unset options
end
config imap
set ports 143
set options fragmail
end
config mapi
set ports 135
set options fragmail
end
config pop3
set ports 110
set options fragmail
end
config smtp
set ports 25
set options fragmail
end
config nntp
set ports 119
unset options
end
config dns
set ports 53
end
next
end
config firewall proxy-policy
edit 1
set uuid 7df5374e-021e-51ea-e207-43c246918c92
set proxy transparent-web
set srcintf "internal"
set dstintf "port1"
set srcaddr "HOST_WINRDM"
set dstaddr "all"
set service "webproxy"
set action accept
set schedule "always"
set logtraffic all
set groups "RDM_WEB_FILTERING"
set utm-status enable
set webfilter-profile "RDM_LOG_ALL"
set profile-protocol-options "RDM_PROXY"
set ssl-ssh-profile "certificate-inspection"
next
end
config user ldap
edit "LDAP_RDM_AD_CN_1"
set server "172.28.26.50"
set cnid "cn"
set dn "DC=test,DC=local"
set type regular
set username "CN=SVC_ldap,OU=Service Accounts,OU=TEST,DC=test,DC=local"
set password ENC *****
set secure ldaps
set port 636
next
end
config user krb-keytab
edit "http_service"
set principal "HTTP/rdm.test.local@TEST.LOCAL"
set ldap-server "LDAP_RDM_AD_CN_1"
set keytab "******"
next
end
config user group
edit "RDM_WEB_FILTERING"
set member "LDAP_RDM_AD_CN_1"
next
end
Thanks!
Solved! Go to Solution.
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
Hi RDM,
it doesn't work for you, because it can't work.
Explicit proxy handles authentication *before* ie. `CONNECT www.google.com:443.` command from the browser. This is easy, we will just ask to provide credentials and successful authentication is then followed by finally CONNECTing browser to real server.
In transparent web-proxy mode, traffic is handled directly, for authentication you need to reach kerberos portal. There is no command sent from browser to proxy, because browser doesn't know anything about it, it's not configured. Proxy is there, but it pretends it's not, playing it transparent.
Browser connects to real google IP address and opens TLS session to it, issuing normal HTTP GET/POST commands.
This real target server traffic supposed to be sent back to browser needs therefore to be replaced with some authentication request.
This replacement is actually redirection to kerberos portal on Fortigate. This redirection, however, needs ssl inspection. We need to pretend google webserver is asking you to go to your portal to authenticate. This can't be done other way.
Regards,
Fishbone)(
P.S.: google is just an example, it works same way with any other https server
smithproxy hacker - www.smithproxy.org
Hi RDM,
it doesn't work for you, because it can't work.
Explicit proxy handles authentication *before* ie. `CONNECT www.google.com:443.` command from the browser. This is easy, we will just ask to provide credentials and successful authentication is then followed by finally CONNECTing browser to real server.
In transparent web-proxy mode, traffic is handled directly, for authentication you need to reach kerberos portal. There is no command sent from browser to proxy, because browser doesn't know anything about it, it's not configured. Proxy is there, but it pretends it's not, playing it transparent.
Browser connects to real google IP address and opens TLS session to it, issuing normal HTTP GET/POST commands.
This real target server traffic supposed to be sent back to browser needs therefore to be replaced with some authentication request.
This replacement is actually redirection to kerberos portal on Fortigate. This redirection, however, needs ssl inspection. We need to pretend google webserver is asking you to go to your portal to authenticate. This can't be done other way.
Regards,
Fishbone)(
P.S.: google is just an example, it works same way with any other https server
smithproxy hacker - www.smithproxy.org
I'm using explicit proxy and NTLM - it's simple and just worked
Thanks Fishbone.
I already read something like this but I didn't understand it like you explained it to me.
Now it's clear and unfortunately unworkable.
I will stay with the PAC configuration via GPO.
Have a nice day ahead.
Hello Fishbone,
I hope you are doing well after... 3 years now.... A lot happened.
I'm trying to setup this again.
I can now do Deep SSL Inspection with my internal computers.
However, can I really configure Kerberos Auth to catch username into my traffic logs ?
I tried but I cannot make it works. If I specify a LDAP group of users into my Explicit Web proxy policy, it failed with a Denied Access. The computer does not send the kerberos ticket stored on the computer and ready for the fortiGate.
I followed this procedure: https://community.fortinet.com/t5/FortiGate/Technical-Tip-FortiGate-transparent-proxy-with-web-cooki...
But as you are mentioning into your previous post, it does not seem to be possible as the computer does not even know there is a proxy in the middle of this ?
thanks again for help.
Best
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1679 | |
1085 | |
752 | |
446 | |
226 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.