Upstream Proxy in default (implicit) proxy

[AmpeA]

Hi,

I have an issue with my FortiGate config.

I have 2 FG 200D on HA (Active Passive) with Explicit proxy feature enabled because of an upstream proxy necessary to access on the web. This upstream proxy is not managed by our team, so we cannot bypass it.

My question is: is there any way to use the default proxy (implicit) and to refer the upstream proxy?

[Christopher_McMullan]

The implicit or transparent proxy features I'm aware of revolve around WCCP clients and servers. Squid is an example of a transparent proxy server that can easily be configured to interoperate with a FortiGate appliance.

This article explains the details for a generic setup, in case it helps:

http://kb.fortinet.com/kb/microsites/search.do?cmd=displayKC&docType=kc&externalId=FD32926&sliceId=1...

[AmpeA]

Thanks for the reply.

With your solution, can I use the Web, App and AV filtering in default IPv4 Policy and just use the transparent proxy as a upstream proxy redirector?

(Sorry for my english)

Here is a basic schema of our infra. We manage the LAN part... The extranet part is unmanageable and cannot be modified. the only way to access to the web is via the Upstream Proxy (It allows all traffic, just scans some features).

[Christopher_McMullan]

Hmm...what are the proxy's requirements for how the traffic arrives to be properly handled? In other words, with a normal explicit proxy, the proxy needs to be targeted at Layer-3 as the destination, and usually on a specific, non-standard port for web traffic, like 8080. Does the extranet proxy require incoming traffic to target the proxy's IP at port 8080, or a similar destination port?

Using WCCP would likely not work in this case, since you don't have control over their settings.

You could use a VIP bound to your internal interface, translating all incoming traffic targeting port 80 so that the destination IP is mapped to the proxy, and the port mapped to the proxy's port.

[AmpeA]

Unfortunately it doesn't work. When I configure this settings, I can't access to the web... 

A ping to the website is ok, but not web access except if I configure my proxy settings :(

[AmpeA]

Unfortunately it doesn't work. When I configure this settings, I can't access to the web...  A ping to the website is ok, but not web access except if I configure my proxy settings :(

[Christopher_McMullan]

Example:

Internal host - 192.168.50.2/24

Internal gateway (FGT interface) - 192.168.50.1/24

Extranet proxy socket - 1.1.1.1:8080

VIP configuration:

-Bound to internal interface as the 'external' port

-External IP left blank to encompass all addresses

-Mapped IP: 1.1.1.1

-External port: 80

-Mapped port: 8080

Create a policy from internal > WAN, source All, destination VIP.

[AmpeA]

Sorry, I was on holliday without internet access... I will try this solution. I didn't tried this before. I will give you feedback once it's done.

Thanks a lot for your reply