How to filtering traffic if Using Explicit Proxy

[#1]

Dear All, We use Fortigate unit as Explicit Proxy at our customer. But we have some problem when PC client used IP proxy fortigate the PC client can' t filtering by the unit, so the traffic going passtrough. Even if we not create firewall policy from internal port to internet port the PC Client traffic still going passtrough. How we filtering traffic from internal to internet if we using explicit proxy? Please suggest.

[Natanael]

Hi, This Explicit Proxy setting with Control for users only Work with 2 VDOMs for FortiOS 4.0 MR1, but in FortiOS 4.0 MR2, we can use Explicit Proxy an Control in same VDOM. Here there is a Lab procedure for Explicit Proxy an Contro for Users in 4.0 MR2. http://www.soportejm.com.sv/kb/index.php/article/fg-proxy-explicito Regard Natanael Calderón

[ejhardin]

Ok so that is what I have done and no go. I was able to get it to work but I had to change the external interface from wan2 to any. Now it works but some thing are not working. Has anyone tested the following? Webfiltering works but the search engines safe mode does not work. Also HTTPS deep scanning is not working. I have added a protocol profile that inculdes both port 80 and 8080 for http and 443 and 8443 for https. FYI on the web-proxy settings I' m using 8080 for http and 8443 for https. I have also made the same changes in Internet explorer.

[flppds]

When I set up the explicit proxy is not required to configure NAT Central, right? instead if I want that some machines go to internet without proxy I think I should configure it..

[FortiRack_Eric]

Just learned from Fortinet SE that in 4.0 MR2 explicit proxy for HTTPS and av scanning etc do not work in same vdom.

[Maik]

Hi Eric Is this statement only for HTTPS? with my tests I was able to catch an Eicar testfile on HTTP. Also the Webfilter is working on HTTP. looks like i need to double check that with HTTPS as well. regards Maik

[FortiRack_Eric]

indeed, only for HTTPS Cheers, Eric

[Maik]

once again they started to develop something good and stoped somewhere before finished so it can not be used anyway... at least a progress is visible... should I wait for 4.3 now? anyway. thanks for sharing that, Eric. regards Frustrated Maik

[ejhardin]

Fortinet advised me a few weeks ago that HTTPS for the web proxy will be release in 4.3. They stated the reason it was over looked is becuase it is a feature that is not used very much. I do not agree with Fortinet on this one. Also the safe search for google, bing and yahoo currently do not work but will in the next patch.