Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
Pavel
New Contributor

HTTP to HTTPS redirect

Good day to everyone! I faced a real problem with publishing sites with my Fortigate 100D. I have a web-server that published with http port 80. I need to redirect all http trafic to https. We are migrating from Forefront TMG and there I could do this by adding aditional listener on the 443 port and redirecting whole traffic to it. Can I do this with Fortigate 100D? Well actually there is no problem with publishing 80 port by VIPs but I have no idea how to redirect it.. I' ve tried everything but it doesn' t works... Please, help me!
1 Solution
DW_FTNT
Staff
Staff

HTTP to HTTPS redirect was added to 6.2.1 Code   you can terminate 443 on the fortigate or just pass 443 all the way to the server. This link shows how to terminate/offload 443 on the fortigate https://docs.fortinet.com/document/fortigate/6.2.0/cookbook/304594/http-to-https-redirect-for-load-b... here is a link to offloading https://help.fortinet.com/fos50hlp/54/Content/FortiOS/fortigate-load-balancing-52/ldb-ssl-tls-offloa...     if you want to just pass 443 to the server and not terminate the session on the fortigate

edit the vip

"virtual-server-https" --->  set server-type tcp  

we can  redirect other ports like 8080 

using http

edit "virtual-server-http"    

set extport 80

to   

set extport 8080    

be sure to use proxy mode

View solution in original post

10 REPLIES 10
emnoc
Esteemed Contributor III

Can' t you just create to vips or port-forward for 80 & 443? So when the client initially connects to http://x.x.x.x:80 and get' s the 3XX redirection, h automatically connects at https://x.x.x.x:443 or whatever port in the redirection. Just ensure you craft your firewall-policies for the correct service/ports for the VIP.

PCNSE 

NSE 

StrongSwan  

PCNSE NSE StrongSwan
ejhardin
Contributor

The web server would have to do the redirect as the fortigate is not able to switch protocols. It will open ports but will not move traffic from one protocol to another. You need a FortiWeb or have the web server issue a redirect.
Pavel
New Contributor

Thanks for your feedback! Now I see, my Fortigate just don' t have ssl acceleration... So sad. Wiil try to resolve it somehow. Anyway thanks again!
Istvan_Takacs_FTNT

What do you mean ' no ssl acceleration' ? The 100D comes with a CP8 ASIC that does SSL processing. Suggest to run the following commands to double-check; get hardware status Model name: FortiGate-100D ASIC version: CP8 ........ get vpn status ssl hw-acceleration-status But as previously was mentioned what you want to achieve has nothing to do with Fortigate SSL acceleration. What you need is a simple VIP object that delivers the port 80 connection requests to port 443 on your web server. e.g show firewall vip edit " vip-web-server_HTTPS" set extip <public IP of the web server> set extintf " WAN1" set portforward enable set mappedip <private IP of the web server> set extport 80 set mappedport 443 next
AndreaSoliva
Contributor III

Hi I suggest following. Go to your FortiGate Support Account and/or Partner Account. Look and/or Search for following document: How to configure TMG features on FortiGate There is a FortiGate document which explains how to transfer this stuff of configuration. What you like to to is actually a reverse proxy on a fortigate. On such configuration is possible to have outside https teriminating on FGT and FGT does SSL offloading and forward the traffic to the server by http etc. Also ActivSynch implementation are step by step explaind. Have a try hope this helps have fun Andrea
Christopher_McMullan

It sounds like the initial connection needs to be made over port 80 and connect to the server on port 443, not the reverse. My knowledge usually only expands through training, helping others with their tickets, or when someone calls in because something is wrong (no one calls in when everything works!) All that being said, a VIP used as a virtual server for a reverse proxy can be set with ssl-mode full or half. Full encrypts both legs (client > FortiGate and FortiGate > server). Half encrypts the client > FortiGate portion. In both cases, unless I' m missing something, you still need the client to target port 443 on the FortiGate. Please feel free to pile on if there are exceptions. The CLI reference for OS 5.0 details this under ' config firewall vip' on page 228.

Regards, Chris McMullan Fortinet Ottawa

Pavel
New Contributor

Huge thanks for your feedback!!! All your posts were helpfull! The problem was with firmware (I have a virtual WAN with 3 physical caonnections from 2 IPS). After upgrading to v 5.2.1 ssl offloading started to work fine. And then Cristopher McMullans post helped me with ssl-http-location conversion! So thanx to you all guys! And sorry for late reply!
DW_FTNT

HTTP to HTTPS redirect was added to 6.2.1 Code

 

you can terminate 443 on the fortigate or just pass 443 all the way to the server.

This link shows how to terminate/offload 443 on the fortigate

https://docs.fortinet.com/document/fortigate/6.2.0/cookbook/304594/http-to-https-redirect-for-load-b...

here is a link to offloading

https://help.fortinet.com/fos50hlp/54/Content/FortiOS/fortigate-load-balancing-52/ldb-ssl-tls-offloa...

 

 

if you want to just pass 443 to the server and not terminate the session on the fortigate

edit the vip

"virtual-server-https"

--->  set server-type tcp

 

we can  redirect other ports like 8080  using http

edit "virtual-server-http"

    set extport 80

to

   set extport 8080

 

 

be sure to use proxy mode

DW_FTNT
Staff
Staff

HTTP to HTTPS redirect was added to 6.2.1 Code   you can terminate 443 on the fortigate or just pass 443 all the way to the server. This link shows how to terminate/offload 443 on the fortigate https://docs.fortinet.com/document/fortigate/6.2.0/cookbook/304594/http-to-https-redirect-for-load-b... here is a link to offloading https://help.fortinet.com/fos50hlp/54/Content/FortiOS/fortigate-load-balancing-52/ldb-ssl-tls-offloa...     if you want to just pass 443 to the server and not terminate the session on the fortigate

edit the vip

"virtual-server-https" --->  set server-type tcp  

we can  redirect other ports like 8080 

using http

edit "virtual-server-http"    

set extport 80

to   

set extport 8080    

be sure to use proxy mode

Labels
Top Kudoed Authors