WAN Opt & Web Cache, Firewall vs web proxy

[s_rowe]

Hi, I am looking to enable Web Cacheing for internet traffic, but am struggling to understand the reason for enabling explicit web proxy and using the FortiGate as a proxy server when I can simply enable web caching and use standard firewall rules. The FortiGate will be an upstream gateway for the internet for users PC' s so there is no need to have their browsers pointing to a proxy server. I am also looking to turn on FSAE authentication and will utilize the FSAE_Guest_users group for non-domain machines. I can use a combination of domain users and FSAE_Guest_Users with standard firewall policies, but if i turn on the explicit proxy, I cannot use FSAE_Guest_Users in the web proxy > WAN firewall rule. Can someone please explain the advantages of using the explicity web proxy or disadvantages of not using it in my scenario? Thanks a lot for any feedback! Cheers, Shannon

[billp]

Shannon, I' m taking an educated guess here. . . The " web cacheing" feature is brand new on FortiOS MR3. Prior to that, you HAD to use explicit web proxy and VDOMS if you wanted to cache web traffic and apply any type of filtering. So, if the new web cacheing feature works well for you, it would make sense to use it. It' s certainly A LOT simpler to set up. There are probably other reasons here as well. Caveat -- I don' t use any type of cacheing on my boxes. The above is just based on my prior research.

[s_rowe]

Hi, Thanks billp, that does make sense for web filtering, however I am still using MR2 and can enable web caching inside WAN Opt without having to turn on explicit web proxy and use multiple VDOMS and it seems to work very well. Cheers, Shannon

[billp]

From my memory, one of the problems with NOT using VDOMS is that you lose the ability to authenticate users and/or run any type of UTM functions on the WAN rule that caches content. Again -- this is just from memory. I tried it once, and when I realized I had to fiddle with VDOMS to get any type of " normal" filtering on the cached content, I gave up. The " cache web content" checkbox on MR3 firewall rules definitely looks like the way to go for my particular setup once MR3 is stable. In any event, would appreciate hearing your experiences here.

[s_rowe]

Hmm I see, thats good to know. I am trying to avoid setting up multiple VDOM' s, so maybe I will wait till the next patch of MR3. I Hear the first release is not stable at all. Thanks for your comments, I will add some findings when I have done some testing