FortiPAM Proxy issue with media servers

[sandtor]

We have recently started using FortiPAM 1.5 and are experiencing some challenges.

We have a SCADA system for video, which is based on MediaMTX with three video servers.
The issue is that when I create a "web account" target with the associated secret, I am able to log in to the SCADA website itself.
However, the video is opened directly from my PC to the video servers. This traffic needs to go through the proxy, just like the SCADA website.

I have tested various things, including adding the IP addresses of the video servers to the Domain list IP mask list on the target.
This has not helped. FortiPAM does have access to all the video servers over the local network.

What needs to be done to make this work? 

[Jean-Philippe_P]

Hello sandtor, 

Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible. 

Thanks, 

[Jean-Philippe_P]

Hello,

We are still looking for an answer to your question.

We will come back to you ASAP.

Thanks,

[Jean-Philippe_P]

Hello!

I found this Solution. Can you tell me if it helps, please?

To ensure that the video traffic is routed through the proxy, similar to the SCADA website, follow these steps:

1. Verify Web Proxy Configuration: Ensure that the web proxy feature is enabled globally on the interface handling incoming and outgoing traffic. Use the CLI commands: `shell config system interface edit "port1" set explicit-web-proxy enable next end `
   
   
2. Configure the Secret Target:
   - When creating the secret target, ensure that the `Web Proxy` option is enabled in the `Advanced Web Setting` pane.
   - Add the IP addresses of the video servers to the `FQDN List` instead of the `IP Mask List`. This ensures that the domain names are resolved and routed through the proxy.
   
   
3. Access Mode: Ensure that the `Access Mode` is set to `Proxy` for the domain list.
   
   
4. Firewall and Proxy Configuration: Check the firewall and proxy settings to ensure that the traffic from the video servers is allowed and properly routed through the proxy.
   
   
5. Test and Validate: After making these changes, test the configuration to ensure that the video traffic is now being routed through the proxy.

If the issue persists, further investigation into the network configuration and proxy settings may be required.

[sandtor]

Hi

Thnx for the desciption on how to do this. As you can see under I have changed from IP to FQDN. FortiPAM can ping using the FQDN. In the policy I have changed the allowed services to ALL. But as you can see in the last image, the video traffic is still going from the client IP and is not proxied through FortiPAM.

10.161.0.55 is the client IP that I'm using to login to FortiPAM.

10.160.16.53 is one of the video servers.