Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
New Contributor III

FortiOS Explicit Proxy rule based on client(!) HTTP header

Hi there,


we want to establish Microsoft approach of a "mikro vm" with "application guard" and edge (+chrome+firefox). So in best case we can use one proxy for all use cases, free internet through application guard and restricted internet through default browsing.

Microsoft Edge and Microsoft Defender Application Guard | Microsoft Docs


When we enable ApplicationGuardTrafficIdentificationEnabled ( Microsoft Edge Browser Policy Documentation | Microsoft Docs ) the browser in the sandbox sends for his requests an additional http header "X-MS-ApplicationGuard-Initiated". So if i can believe in wireshark, yes this header is send seems not to have any effect on the fortigate


We tried the following rule and used as "source"a proxy address (to be honest, we tried several other things but this seems to be the right way...from my understanding)


Just to mention, when we set the host in gui, after we apply, and reopen it, this field is empty again...but when we check in the cli, it is all there.



So anyway, we set this as source but the rule seems not to have any effect. Any ideas how we can archive this to be handleb by fortigate?


Kind regards

1 Solution

"X-MS-ApplicationGuard-Initiated: 1" should be trivial to match:

HTTP host header proxy address objectHTTP host header proxy address object

(replace the Host option with whichever source-IP address object you need).


The HTTP/HTTPs part is a good question.
Are these headers supposed to be included in the outer request to the proxy (proxy will always see them), or are they supposed to be included in the inner request? (they would be sent to the real destination server, and DPI would be needed to see them inside encrypted traffic)

Only the first one (outer request to proxy) makes sense to me, but I'm not a MS expert. :)

[ corrections always welcome ]

View solution in original post


How about to export/copy HTTP headers as plain text from Wireshark and place them to something like to test.
It's more about to make sure that string in header is exactly what you expect, because your "/string/g" regex is pretty simple.
I just guess you are logging "All sessions" on that Proxy-policy at least now for debug purposes. So is anything hitting that policy and showed up in logs?

Is it HTTP or HTTPS traffic ? ;)

Tomas Stribrny - NASDAQ:FTNT - Fortinet Inc. - TAC Staff Engineer
AAA, MFA, VoIP and other Fortinet stuff


thanks for your help, followed this which leads to the solution. the value is 1 and we had previously no matches on the policy. Solved now



great to hear that it's fixed now.

Tomas Stribrny - NASDAQ:FTNT - Fortinet Inc. - TAC Staff Engineer
AAA, MFA, VoIP and other Fortinet stuff


Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Top Kudoed Authors