HTTP to HTTPS redirect

[Pavel]

Good day to everyone! I faced a real problem with publishing sites with my Fortigate 100D. I have a web-server that published with http port 80. I need to redirect all http trafic to https. We are migrating from Forefront TMG and there I could do this by adding aditional listener on the 443 port and redirecting whole traffic to it. Can I do this with Fortigate 100D? Well actually there is no problem with publishing 80 port by VIPs but I have no idea how to redirect it.. I' ve tried everything but it doesn' t works... Please, help me!

[emnoc]

Can' t you just create to vips or port-forward for 80 & 443? So when the client initially connects to http://x.x.x.x:80 and get' s the 3XX redirection, h automatically connects at https://x.x.x.x:443 or whatever port in the redirection. Just ensure you craft your firewall-policies for the correct service/ports for the VIP.

[ejhardin]

The web server would have to do the redirect as the fortigate is not able to switch protocols. It will open ports but will not move traffic from one protocol to another. You need a FortiWeb or have the web server issue a redirect.

[Pavel]

Thanks for your feedback! Now I see, my Fortigate just don' t have ssl acceleration... So sad. Wiil try to resolve it somehow. Anyway thanks again!

[Istvan_Takacs_FTNT]

What do you mean ' no ssl acceleration' ? The 100D comes with a CP8 ASIC that does SSL processing. Suggest to run the following commands to double-check; get hardware status Model name: FortiGate-100D ASIC version: CP8 ........ get vpn status ssl hw-acceleration-status But as previously was mentioned what you want to achieve has nothing to do with Fortigate SSL acceleration. What you need is a simple VIP object that delivers the port 80 connection requests to port 443 on your web server. e.g show firewall vip edit " vip-web-server_HTTPS" set extip <public IP of the web server> set extintf " WAN1" set portforward enable set mappedip <private IP of the web server> set extport 80 set mappedport 443 next

[AndreaSoliva]

Hi I suggest following. Go to your FortiGate Support Account and/or Partner Account. Look and/or Search for following document: How to configure TMG features on FortiGate There is a FortiGate document which explains how to transfer this stuff of configuration. What you like to to is actually a reverse proxy on a fortigate. On such configuration is possible to have outside https teriminating on FGT and FGT does SSL offloading and forward the traffic to the server by http etc. Also ActivSynch implementation are step by step explaind. Have a try hope this helps have fun Andrea

[Christopher_McMullan]

It sounds like the initial connection needs to be made over port 80 and connect to the server on port 443, not the reverse. My knowledge usually only expands through training, helping others with their tickets, or when someone calls in because something is wrong (no one calls in when everything works!) All that being said, a VIP used as a virtual server for a reverse proxy can be set with ssl-mode full or half. Full encrypts both legs (client > FortiGate and FortiGate > server). Half encrypts the client > FortiGate portion. In both cases, unless I' m missing something, you still need the client to target port 443 on the FortiGate. Please feel free to pile on if there are exceptions. The CLI reference for OS 5.0 details this under ' config firewall vip' on page 228.

[Pavel]

Huge thanks for your feedback!!! All your posts were helpfull! The problem was with firmware (I have a virtual WAN with 3 physical caonnections from 2 IPS). After upgrading to v 5.2.1 ssl offloading started to work fine. And then Cristopher McMullans post helped me with ssl-http-location conversion! So thanx to you all guys! And sorry for late reply!

[DW_FTNT]

HTTP to HTTPS redirect was added to 6.2.1 Code

you can terminate 443 on the fortigate or just pass 443 all the way to the server.

This link shows how to terminate/offload 443 on the fortigate

https://docs.fortinet.com/document/fortigate/6.2.0/cookbook/304594/http-to-https-redirect-for-load-b...

here is a link to offloading

https://help.fortinet.com/fos50hlp/54/Content/FortiOS/fortigate-load-balancing-52/ldb-ssl-tls-offloa...

if you want to just pass 443 to the server and not terminate the session on the fortigate

edit the vip

"virtual-server-https"

--->  set server-type tcp

we can  redirect other ports like 8080  using http

edit "virtual-server-http"

    set extport 80

to

   set extport 8080

be sure to use proxy mode

[DW_FTNT · Accepted solution]

HTTP to HTTPS redirect was added to 6.2.1 Code   you can terminate 443 on the fortigate or just pass 443 all the way to the server. This link shows how to terminate/offload 443 on the fortigate https://docs.fortinet.com/document/fortigate/6.2.0/cookbook/304594/http-to-https-redirect-for-load-b... here is a link to offloading https://help.fortinet.com/fos50hlp/54/Content/FortiOS/fortigate-load-balancing-52/ldb-ssl-tls-offloa...     if you want to just pass 443 to the server and not terminate the session on the fortigate

edit the vip

"virtual-server-https" --->  set server-type tcp  

we can  redirect other ports like 8080 

using http

edit "virtual-server-http"    

set extport 80

to   

set extport 8080    

be sure to use proxy mode