Transparent web proxy and Exempt List in v5.0.9

[Frosty]

We have an FG200B running v5.0.9 and we want to start using the Transparent Web Proxy features again (we do have an SSD in the FG200B).

I configured a Policy limited to just a couple of PCs and ticked the appropriate box.  The Monitor in the FG200B shows that the transparent proxy is working.  So far so good.

Now I want to configure an Exempt List for URLs which don't work so good with the transparent proxy. 

Nothing I can see in the GUI, so I check the FortiOS Handbook. 

It says go to "WAN Opt & Cache > Cache > Exempt List" ... except my GUI doesn't have this option.

The handbook also says use "config wanopt webcache" and then "set cache-exemption enable" ... except my CLI doesn't have this option.

Can anyone shed any light on this?  Does the FG200B simply not have this level of configuration available?  I know it used to be available back in v4.3, so was it removed for some reason?

[Dave_Hall · Accepted solution]

Stephen Frost wrote:

It says go to "WAN Opt & Cache > Cache > Exempt List" ... except my GUI doesn't have this option.

The handbook also says use "config wanopt webcache" and then "set cache-exemption enable" ... except my CLI doesn't have this option.

Can anyone shed any light on this?  Does the FG200B simply not have this level of configuration available?  I know it used to be available back in v4.3, so was it removed for some reason?

I think sometime around 4.3.11 time-frame, disk logging and web caching has been disabled on the 200B by default.  But I believe you can re-enable it via the CLI.  I never bothered to try web caching on 5.0.x, so didn't/don't know if it was/is available.

Just shipped out my last available 200B, so not able to test web caching on that model.  On the 200D, the syntax is different than what is listed on page 84 of the CLI ref guide.

config web-proxy url-match
    edit "label"
        set status enable

        set cache-exemption enable
        set url-pattern "www.example.com"
    next
end

[Frosty]

Dave Hall wrote:
config web-proxy url-match

You're a gem, thanks!  I feel like a bit of an idiot, because when I went to "config web-proxy url-match" I found all my old v4.3 exemption URLs sitting there; they hadn't been lost from the configuration as I had thought:

config web-proxy url-match     edit "Exempt-Site-MicrosoftNCSI-1"         set cache-exemption enable         set url-pattern "msftncsi"     next     edit "Exempt-Site-MicrosoftNCSI-2"         set cache-exemption enable         set url-pattern "ncsi.txt"     next     edit "Exempt-Site-MicrosoftSchemas"         set cache-exemption enable         set url-pattern "schemas.microsoft.com"     next     edit "Exempt-Site-MicrosoftSTO"         set cache-exemption enable         set url-pattern "microsoftsto"     next     edit "Exempt-Site-WindowsUpdate-1"         set cache-exemption enable         set url-pattern "download.windowsupdate.com"     next     edit "Exempt-Site-WindowsUpdate-2"         set cache-exemption enable         set url-pattern "download.microsoft.com"     next     edit "Exempt-Site-WindowsUpdate-3"         set cache-exemption enable         set url-pattern "www.update.microsoft.com"     next     edit "Exempt-Site-WindowsUpdate-4"         set cache-exemption enable         set url-pattern "207.46.61.90"     next     edit "Exempt-Site-YouTube"         set cache-exemption enable         set url-pattern "youtube.com"     next end

[Frosty]

Ahhhh ... found it !!! ... it IS in the GUI, just not in the place mentioned in the Fortinet documentation:

VDOMs, root, System, Network, Explicit Proxy, section: URL Match List

I'm not using an Explicit Proxy, so I would never have thought to look here for the transparent web caching exempt URL list.  I just happened to be clicking around and found it by accident.

My "URL Match List" shows a green 'tick' under the column "Cache Exemption".  I guess I will have to find out exactly what that means ... does it mean "don't allow anything matching this to be cached" ... or something else?  I tried clicking on Help but it went to a broken URL.

[laf]

Hi guys,

Is it possible to setup Fortigate as Transparent proxy on NAT/route mode or is this a Transparent mode Fortigate deployment?

Thanks in advance!