Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
m3ds0
New Contributor III

SSL-OffLoading (HTTP --> HTTPS)

Hi mates,

I'm trying to test "SSL offloading" scenario in my lab with Fortigate v7.0.14 on kvm, as i should clear the scenario, it is simple process which we can achieve for example with nginx as a reverse proxy.

There is a web-server ( 10.11.12.10) which placed in DMZ and there are WAN and MGMT interfaces as well.

 

I'm trying to configure fortigate to act as revers-proxy to offload SSL be half of web-server.

 

(Client from internet DST port 443 and using HTTPS in URL indeed)---> (WAN Port)-(Fortigate)-(DMZ port)--->( Web-server Port80 )

 

I used "virtual servers" for the solution and here's my configuration:

 

config firewall vip
edit "vweb"
set uuid 3757f926-f35e-51ee-348e-fdc06559ea6e
set type server-load-balance
set extip 172.29.129.190
set extintf "port2"
set server-type https
set http-ip-header enable
set ldb-method round-robin
set persistence http-cookie
set extport 443
config realservers
edit 1
set ip 10.11.12.10
set port 80
next
end
set http-multiplex enable
set ssl-certificate "myCert"
next
end

and the policy part is :

onfig firewall policy
edit 1
set name "vweb-pol"
set uuid 98a37f10-f35f-51ee-06e0-d2ac753cc21c
set srcintf "port2"
set dstintf "port3"
set action accept
set srcaddr "all"
set dstaddr "vweb"
set schedule "always"
set service "ALL"
set inspection-mode proxy
set logtraffic all
set nat enable
next
end

 

when client from internet tries to reach my web-server gets error for instance on Firefox "Error code: PR_END_OF_FILE_ERROR"

during debugging on fortigate with diag command there where nothing wrong.

 

I don't know it's all about virtualization thing or license which is Eval, I'm glad if someone read my configuration and or have any suggestions.

 

Regrads

They say the empty can rattles the most!
They say the empty can rattles the most!
7 REPLIES 7
dbu
Staff
Staff

Hi @m3ds0 ,

I believe this is a secure connection issue specific to Firefox browser.
Through a quick search i found these possible workarounds:

  1. Disable Your Third-Party Security Software
  2. Disable Your VPN or Proxy
  3. Reset Firefox’s Secure Sockets Layer (SSL) Settings
  4. Disable the Domain Name System (DNS) Over HTTPS Within Firefox
  5. Create a New Firefox Profile
Regards!
If you have found a solution, please like and accept it to make it easily accessible for others.
m3ds0
New Contributor III

Hi @dbu ,

Unfortunately it isn't about the firefox or any web browsers, packets from fortigate not received by web server! 

They say the empty can rattles the most!
They say the empty can rattles the most!
ozkanaltas
Valued Contributor III

Hello @m3ds0 ,

 

Fortigate uses low encryption keys in the eval mod. Because of that modern browsers can't accept this cipher suite. I think your problem source this is.

 

I don't know is there any related setting on the browser. Maybe you can try with the old version browser.

If you have found a solution, please like and accept it to make it easily accessible to others.
NSE 4-5-6-7 OT Sec - ENT FW
If you have found a solution, please like and accept it to make it easily accessible to others.NSE 4-5-6-7 OT Sec - ENT FW
m3ds0
New Contributor III

Hi @ozkanaltas ,

You mean even when i set ssl-algorithms to high fortigate uses low one?!

They say the empty can rattles the most!
They say the empty can rattles the most!
AEK
SuperUser
SuperUser

Hi @m3ds0 

First, I'd suggest to try with port 80, just to see if the issue is in ciphering side or somewhere else.

For that you can add a temporary additional virtual server listening on port 80, then try to force access on http://172.29.129.190:80.

AEK
AEK
m3ds0
New Contributor III

I've tried http mode and its works without problem but no luck in https!

They say the empty can rattles the most!
They say the empty can rattles the most!
AEK

Hello @m3ds0 

I replicated your configuration in my lab and it worked successfully.

I think @ozkanaltas is right about FG demo low encryption.

AEK
AEK
Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors