Explicit transparent proxy with Kerberos Auth

[RDM]

Hello there,

I'm trying to configure Explicit Proxy on my Fortigate 500E with FortiOS 6.0.5 and no luck so far.

My Fortigate is linked to my fortianalyzer and I just want to log every http/https traffic without any deep inspection SSL.

I followed multiple tutorials that we can found online and everything is pretty working well when we are using a PAC file (and add it to our web browsers configuration).

However, I want to make my last step and make it works transparently.

It seems to work well with HTTP website. When I call it, my kerberos ticket is created on my workstation and when I go on my firewall user monitor I can see my user logged with attribute Explicit + Firewall.

But if I browse an HTTPS website, I always have a certificate SSL error (and I don't want to import my fortigate SSL certificat into all my workstations).

I don't understand why it works well when proxy information is added to the web browser and with the same "filtering option" in transparent, it works with http site but not HTTPS.

Any tips for me ?

here my configuration:

config authentication setting
    set active-auth-scheme "Kerberos"
    set captive-portal "WEBPROXY_PORTAL"
    set captive-portal-port 9666
end

config authentication scheme
    edit "Kerberos"
        set method negotiate
        set kerberos-keytab "http_service"
    next
end

config authentication rule
    edit "WINRDM_Kerberos"
        set srcaddr "HOST_WINRDM"
        set ip-based disable
        set active-auth-method "Kerberos"
        set web-auth-cookie enable
    next
end

config firewall profile-protocol-options
    edit "RDM_PROXY"
        set oversize-log enable
        config http
            set ports 80 8080
            unset options
            set http-policy enable
            unset post-lang
        end
        config ftp
            set ports 21
            unset options
        end
        config imap
            set ports 143
            set options fragmail
        end
        config mapi
            set ports 135
            set options fragmail
        end
        config pop3
            set ports 110
            set options fragmail
        end
        config smtp
            set ports 25
            set options fragmail
        end
        config nntp
            set ports 119
            unset options
        end
        config dns
            set ports 53
        end
    next
end

config firewall proxy-policy
    edit 1
        set uuid 7df5374e-021e-51ea-e207-43c246918c92
        set proxy transparent-web
        set srcintf "internal"
        set dstintf "port1"
        set srcaddr "HOST_WINRDM"
        set dstaddr "all"
        set service "webproxy"
        set action accept
        set schedule "always"
        set logtraffic all
        set groups "RDM_WEB_FILTERING"
        set utm-status enable
        set webfilter-profile "RDM_LOG_ALL"
        set profile-protocol-options "RDM_PROXY"
        set ssl-ssh-profile "certificate-inspection"
    next
end

config user ldap
    edit "LDAP_RDM_AD_CN_1"
        set server "172.28.26.50"
        set cnid "cn"
        set dn "DC=test,DC=local"
        set type regular
        set username "CN=SVC_ldap,OU=Service Accounts,OU=TEST,DC=test,DC=local"
        set password ENC *****
        set secure ldaps
        set port 636
    next
end

config user krb-keytab
    edit "http_service"
        set principal "HTTP/rdm.test.local@TEST.LOCAL"
        set ldap-server "LDAP_RDM_AD_CN_1"
        set keytab "******"
    next
end

config user group
    edit "RDM_WEB_FILTERING"
        set member "LDAP_RDM_AD_CN_1"
    next
end

Thanks!

[Fishbone_FTNT · Accepted solution]

Hi RDM,

it doesn't work for you, because it can't work.

Explicit proxy handles authentication *before* ie. `CONNECT www.google.com:443.` command from the browser. This is easy, we will just ask to provide credentials and successful authentication is then followed by finally CONNECTing browser to real server.

In transparent web-proxy mode, traffic is handled directly, for authentication you need to reach kerberos portal. There is no command sent from browser to proxy, because browser doesn't know anything about it, it's not configured. Proxy is there, but it pretends it's not, playing it transparent.

Browser connects to real google IP address and opens TLS session to it, issuing normal HTTP GET/POST commands.

This real target server traffic supposed to be sent back to browser needs therefore to be replaced with some authentication request.

This replacement is actually redirection to kerberos portal on Fortigate. This redirection, however, needs ssl inspection. We need to pretend google webserver is asking you to go to your portal to authenticate. This can't be done other way.

Regards,

Fishbone)(

P.S.: google is just an example, it works same way with any other https server

[James_G]

I'm using explicit proxy and NTLM - it's simple and just worked

https://docs.fortinet.com...317921/ntlm-extensions

[RDM]

Thanks Fishbone.

I already read something like this but I didn't understand it like you explained it to me.

Now it's clear and unfortunately unworkable.

I will stay with the PAC configuration via GPO.

Have a nice day ahead.

[RDM]

Hello Fishbone,

I hope you are doing well after... 3 years now.... A lot happened.

I'm trying to setup this again.

I can now do Deep SSL Inspection with my internal computers.

However, can I really configure Kerberos Auth to catch username into my traffic logs ?

I tried but I cannot make it works. If I specify a LDAP group of users into my Explicit Web proxy policy, it failed with a Denied Access. The computer does not send the kerberos ticket stored on the computer and ready for the fortiGate.

I followed this procedure: https://community.fortinet.com/t5/FortiGate/Technical-Tip-FortiGate-transparent-proxy-with-web-cooki...

But as you are mentioning into your previous post, it does not seem to be possible as the computer does not even know there is a proxy in the middle of this ?

thanks again for help.

Best