Forti deployment problem.

[MohamedAmmar]

Hello all , 

      Good day for you .. I'm a newbie to FortiGate and currently deploying a FortiGate 100D and want to customize it to my LAN , but i'm facing some issues , and here's the situation.

1 - I'm using Layer 3 Switch as default gateway which route to internet through ASA as static route . I don't want to change that .

2 - I want to make fortiGate as a firewall before another internet connection. and access it as a proxy to bypass my default configurations.

The main configurations i made : 

1 - FortiGate in NAT mode. ( Does it help to change it to transparent ? ) 

2 - I've enabled the ' explicit proxy ' and checked it on the LAN interface

The obstacles i'm facing are : 

1 - I want to deploy the IPV4 rules not explicit rules , Can I ? i want it to deploy policies based on Single sign. I synch it with my Microsoft AD LDAP. But in explicit proxy , i can not deploy policies based on users.

I there is a help to obtain a solution where user can access specific internet connection through proxy ( FortiGate ) and policies can be based on FSSO ? Thanks.

[MohamedAmmar]

Any help ?? 

[MikePruett]

I have read through your post a few times but I cant decipher what exactly you are trying to do exactly.

You want the FortiGate to have it's own internet connection separate from the ASA that way you can bypass the ASA etc?

[MohamedAmmar]

Yes. I want that .. I want a PC in my LAN to access it by changing the proxy settings from internet options , and uses the IP of Forti as it's proxy server. 

Thanks, 

[emnoc]

Than set the  Fortigate up  with a local interface on the LAN with the PC, configure the PC as a proxy-client and ensure the fortigate has internet connection and the correct fwpolicies

Ken

[MohamedAmmar]

That's what i made , but the problem that : 

1 - IPV4 in ( Policy and objects ) not deployed on the clients. only explicit proxy rules.

2 - Explicit proxy rules doesn't have the option of FSSO. IT's only filter based on IP address.

Thanks,

[emnoc]

hmm not following you;

1: if you want a fortigate as explicit proxy  the  flow  should be simple

   A: build the fgt

   D: set the clients to use the explicit proxy

   C: define authorition ( optional ) for the exp-proxy

   D: ensure policy and if use web-filters  are applied

2: So what have you configured?

3: Take a look at this topology  map and here's a basic cfg with NO AUTHEN ( no identity ) , try this 1st b4 you  do any thing else.

config web-proxy explicit     set status enable     set realm " auth webproxy"     set ssl-algorithm high end

config system interface     edit "internalLAN"         set vdom "root"         set ip 192.168.11.100         set allowaccess ping https ssh         set type physical         set explicit-web-proxy enable     next end

config firewall explicit-proxy-policy     edit 1         set proxy web         set dstintf "wan1"         set srcaddr "MYALLOWEDCLIENTS"         set dstaddr "all"         set service "webproxy"         set action accept         set schedule "always"         set logtraffic disable     next end

So to this you would do (linux/macosx etc.. or a window IE/FF browser set for the explict proxy address no auth )

e.g

 curl -x 192.168.11.100:8080 ifconfig.me

if you get out the  website reports your  firewall public address, than you know the proxy works.

if you want authentication you need to set a user group and identity base policy and set the   auth type for the  proxy

e.g

config firewall explicit-proxy-policy     edit 1

        set identity-based enable         set active-auth-metho basic    end

 and then build your identity policies

   > You can run a local firewall for ALL other and a explicit-proxy on the   FGT for your internal users.

   > I've done that numerous times and once you do this, you can set groups, webfilters etc.......

 I hope that helps and can get you started.

Ken

PM me if you get stuck

[emnoc]

b4 I forget  the object "MYALLOWEDCLIENTS" would be a address range or group of address

i.e

config firewall address

   edit MYALLOWEDCLIENTS"

        set subnet 192.168.11.0/24

        set comment " my internal lan users  at yourdomain.com "

    end

This  will allow you to restrict the  users to a range or subnet or address-group.....etc...