Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
Mohamed_Gaber
Contributor

WAF and Load balancer cascaded for Web servers

We have a problem with WAF and Load balancer cascaded for Web servers. The Apache Tomcat web servers reply with a redirect status code 302 with the location field containing the URL configured in it.

I need to know:

- The WAF modifies which levels or places of the packet.

- The Load balancer modifies which levels or places of the packet.

- The URL configured in the web servers should be what? Should I add an entry to the hosts file of it?

 

Does the HTTP header include a URL or just the IP in the network address?

In this case, do any of the security devices (specially WAF) change the URL to the destination server IP or it does not touch it?

 

Could I capture the packets on WAF and load balancer to see both the HTTP headers and network IP?

or even in the log.

Mohamed Gaber
Cell : +201001615878
E-mail : mohamed.gaber@alkancit.com
Mohamed GaberCell : +201001615878E-mail : mohamed.gaber@alkancit.com
9 REPLIES 9
Anthony_E
Community Manager
Community Manager

Hello Mohamed,


Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible.


Thanks,

Anthony-Fortinet Community Team.
Mohamed_Gaber
Contributor

I have to core problems I recognized in this problem:

- I don't understand the HTTP protocol well enough.

- I don't understand FortiWeb & FortiADC well enough. Just push them to work. No time to well understand. I feel sorry for that.

Mohamed Gaber
Cell : +201001615878
E-mail : mohamed.gaber@alkancit.com
Mohamed GaberCell : +201001615878E-mail : mohamed.gaber@alkancit.com
Anthony_E
Community Manager
Community Manager

Hi Mohamed,

 

Did you find a solution? We're happy to help or point you to documentation resources if you'd like to learn more about the products.

 

Regards,

Anthony-Fortinet Community Team.
Mohamed_Gaber

Thanks and appreciate that.

I need to know the content of the HTTP header and if it includes the URL as entered by the client.

The levels in the packet which be modified by the WAF and load Balancer.

Should the web server be configured by the IP that the WAF sends the packet to?

I don't know how the packet that reaches the web server looks and the server should be configured to work with it.

 

If there are documents that explain this, I thank you for that.

If I get a direct reply, I thank you for this also.

 

I need also to capture the packet while it passes through the security devices to monitor the change.

Mohamed Gaber
Cell : +201001615878
E-mail : mohamed.gaber@alkancit.com
Mohamed GaberCell : +201001615878E-mail : mohamed.gaber@alkancit.com
Anthony_E
Community Manager
Community Manager

Hello Mohamed,

 

We will find the documentations needed and will provide it to you :)!

 

Regards,

Anthony-Fortinet Community Team.
Anthony_E
Community Manager
Community Manager

Hello Mohamed,

 

First here some document for helping you:

 

Creating HTML headers:

https://docs.fortinet.com/document/fortiweb/7.0.4/cli-reference/667138/waf-http-header-security

 

Packet capture:

https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-Packet-Capture-on-FortiOS-GUI/ta-p/1...

 

Some administration information about FortiWeb web servers: https://help.fortinet.com/fweb/586/Content/FortiWeb/fortiweb-admin/define_web_servers.htm 

 

Regards,

Anthony-Fortinet Community Team.
Mohamed_Gaber

Thanks and appreciated,

I will be most happy the moment I clearly understand these all.

I feel shame for the current state.

Mohamed Gaber
Cell : +201001615878
E-mail : mohamed.gaber@alkancit.com
Mohamed GaberCell : +201001615878E-mail : mohamed.gaber@alkancit.com
Anthony_E
Community Manager
Community Manager

Hello Mohamed,

 

I sincerely hope you will get all the answers you are requesting.

 

Regards,

Anthony-Fortinet Community Team.
Mohamed_Gaber
Contributor

Thanks for your sincere hopes.

As usual, we hardly find the time to read. I have site delivery for systems tested in the office one year ago then moved to sites. We have several problems including hardware problems.

 

I did packet capture. But I was not able to find the required.

The FortiWeb traffic log was better.

It included HTTP Host and URL. The URL does not include the IP or the server name. It includes the target data.

 

It was like this:

Original Source 10.33.6.101
Original Source Country or Region Reserved
Service https/tls1.2
HTTP Version 1.x
Method post
HTTP Host geoportal.gis.local
URL /IDMSCataloguerService/api/RolePrivilage/GetRolePrivilages
Return Code 200
Connection
10.33.6.101:55313 -> 10.33.5.12:443

 

Original Source 10.33.6.101
Original Source Country or Region Reserved
Service https/tls1.2
HTTP Version 1.x
Method get
HTTP Host geoportal.gis.local
URL /IDMSCataloguerService/api/Test
Return Code 200
Connection
10.33.6.101:55312 -> 10.33.5.12:443

 

As I understand from this, there are several headers. This includes "Host" and "URL".

I am not sure If I am correct or not. 

Mohamed Gaber
Cell : +201001615878
E-mail : mohamed.gaber@alkancit.com
Mohamed GaberCell : +201001615878E-mail : mohamed.gaber@alkancit.com
Labels
Top Kudoed Authors