SSL-OffLoading (HTTP --> HTTPS)

[m3ds0]

Hi mates,

I'm trying to test "SSL offloading" scenario in my lab with Fortigate v7.0.14 on kvm, as i should clear the scenario, it is simple process which we can achieve for example with nginx as a reverse proxy.

There is a web-server ( 10.11.12.10) which placed in DMZ and there are WAN and MGMT interfaces as well.

I'm trying to configure fortigate to act as revers-proxy to offload SSL be half of web-server.

(Client from internet DST port 443 and using HTTPS in URL indeed)---> (WAN Port)-(Fortigate)-(DMZ port)--->( Web-server Port80 )

I used "virtual servers" for the solution and here's my configuration:

config firewall vip
edit "vweb"
set uuid 3757f926-f35e-51ee-348e-fdc06559ea6e
set type server-load-balance
set extip 172.29.129.190
set extintf "port2"
set server-type https
set http-ip-header enable
set ldb-method round-robin
set persistence http-cookie
set extport 443
config realservers
edit 1
set ip 10.11.12.10
set port 80
next
end
set http-multiplex enable
set ssl-certificate "myCert"
next
end

and the policy part is :

onfig firewall policy
edit 1
set name "vweb-pol"
set uuid 98a37f10-f35f-51ee-06e0-d2ac753cc21c
set srcintf "port2"
set dstintf "port3"
set action accept
set srcaddr "all"
set dstaddr "vweb"
set schedule "always"
set service "ALL"
set inspection-mode proxy
set logtraffic all
set nat enable
next
end

when client from internet tries to reach my web-server gets error for instance on Firefox "Error code: PR_END_OF_FILE_ERROR"

during debugging on fortigate with diag command there where nothing wrong.

I don't know it's all about virtualization thing or license which is Eval, I'm glad if someone read my configuration and or have any suggestions.

Regrads

[dbu]

Hi @m3ds0 ,

I believe this is a secure connection issue specific to Firefox browser.
Through a quick search i found these possible workarounds:

1. Disable Your Third-Party Security Software
2. Disable Your VPN or Proxy
3. Reset Firefox’s Secure Sockets Layer (SSL) Settings
4. Disable the Domain Name System (DNS) Over HTTPS Within Firefox
5. Create a New Firefox Profile

[m3ds0]

Hi @dbu ,

Unfortunately it isn't about the firefox or any web browsers, packets from fortigate not received by web server! 

[ozkanaltas]

Hello @m3ds0 ,

Fortigate uses low encryption keys in the eval mod. Because of that modern browsers can't accept this cipher suite. I think your problem source this is.

I don't know is there any related setting on the browser. Maybe you can try with the old version browser.

[m3ds0]

Hi @ozkanaltas ,

You mean even when i set ssl-algorithms to high fortigate uses low one?!

[AEK]

Hi @m3ds0 

First, I'd suggest to try with port 80, just to see if the issue is in ciphering side or somewhere else.

For that you can add a temporary additional virtual server listening on port 80, then try to force access on http://172.29.129.190:80.

[m3ds0]

I've tried http mode and its works without problem but no luck in https!

[AEK]

Hello @m3ds0 

I replicated your configuration in my lab and it worked successfully.

I think @ozkanaltas is right about FG demo low encryption.