Web Cache

[kaslasma]

Has anyone been successful at implementing basic web caching? I' m looking to implement with 4.2.1 or 4.2.2. Also, of any of the successful web caching deployments, has anyone tried to cache BITS for Windows updates? or whatever protocol Fortinet uses for the FortiClient updates? I know that a manager is capable of serving updates to the clients, but can a FG cache them as well? Thanks,

[Frosty]

OK, so its not just me then! I recall that the very first few minutes when I turned on the caching it seemed to work, but after about 20-30 minutes it eventually stopped producing any useful stats. So I assumed that I' d misconfigured things and that is what set me off on trying dozens of different configuration ideas, none of which worked. My expection is this: I turn on web caching from source 192.168.0.0/16 (my LAN) to destination 0.0.0.0 (everything) just for port 80 ... and then the Fortigate magically caches all traffic which comes back into the device in response to outgoing port 80 requests. What do I think it may be doing? Maybe its caching the port 80 requests (the outgoing HTTP requests) and isn' t caching the responses? I don' t know. It seems like such a simple concept to me ... I really don' t want to have to fiddle with proxies, group policies and .PAC files on clients ... the whole idea of web caching appealed to me because I thought it would enable me to get rid of all that stuff!

[kaslasma]

I agree with the simple concept. As you can imagine I was extatic to see the results I was getting, now it often appears to have more WAN traffic than LAN traffic for negative caching :-X The other products I' ve used it has been that simple, if not easier! I even skimmed through the 4.2.3 release notes hoping to find something mentioning a bug confirmation or resolution, but no luck. You would think with the release of the 60Cs, and other models supporting SSDs we would see more progress. Maybe other people have better luck with WAN Opt instead of caching? I haven' t tried that yet...

[Frosty]

kaslasma, any chance you could post a screenshot of your web cache rule ... the one which initially worked and produced the obviously good caching results in the screen cap earlier in the thread? I would just like to see what it looked like after entering it, particularly -- the format of the source and destination addressing -- the format of the port (e.g. 80) ... mine always formats itself as 80-80

[veechee]

I' ve got web caching set-up between a head office FGT-60C and a remote office FWF-60C. The head office unit has a 32 GB Class 10 SD Card. The remote office has the 4 GB SD card. I observe no restrictions based on not having the larger card installed in that unit. Both units are connected by IPSec link using static IPs. Following the documentation, I enabled ' tunnel-sharing' to shared for CIFS rules and to private for HTTP and FTP rules. I am not using SSL or Secure Tunnels on any protocols, but I did use the firmware certificate for authenticating the rules, which worked. I later turned that off and the rules still worked. All my observations have been done via SSL VPN on both endpoints, and using a Terminal Server inside the head office network (I' m on holidays which is where I found the time to work on this!). - I have HTTP and FTP traffic successfully caching. - I had to exclude caching the FGT/FWF management interface itself because when i had the whole IP range set to cache, I could not access the interface. I got a proxy error message. The Fortinet documentation does not mention this! - CIFS caching I cannot make work. If I enable the rules for CIFS, it breaks my file shares. At first it looks like they work, and I got some reductions reported in the Monitor, but then they break. From then on, every connection attempt to a share I see it go up by a 60-80 bytes, which I assume is some attempt at authenticating, but it fails in Windows. I' ve tried to cache using both all ports and isolating to 139 and 445, and the results are the same. I guess I need to open a ticket with Fortinet about this. - Caching over SSL VPN works when pulling resources across the IPSec link. This is a nice feature.

[ejhardin]

FYI, The wan opt cache rules will not cache if a firewall rule has any of the UTM options enabled. You can use VDOM' s to config your device like the example in the manual. Wan opt devive (root vdom) and the security device (second vdom).

[Frosty]

Thanks ejhardin! That' s the key, and that' s exactly the response I got back from Fortinet support when I logged a ticket about it. Sorry for my delay in responding, but I' ve been away on leave for a month and only just got back on deck today. I will be arranging to get our Fortigate consultant experts in some time in the next few weeks and we' ll have a go at setting up VDOMs to do the caching functions. Will post again once done to report on how it went.

[Frosty]

Okay, very pleased to report that we had our Fortigate expert consultant out on site today and he has successfully implemented VDOMs for us (one for our main firewall, one for a transparent proxy) and we now have transparent web caching working really well. I' m really pleased with the final outcome. So the key seems to me (a) you must be routing traffic from one Fortigate firewall to another (we get around this by using VDOMs); and (b) no UTM on the transparent proxy! He also solved my LDAP setup problems for me ... we can now authenticate people against Security Groups instead of just OUs for SSL VLN access.

[ede_pfau]

Stephen, would you please update your LDAP post if you find the time? Thanks.

[Frosty]

Done that now ... cheers!

[Frosty]

A word of warning: we had been running 4.0 MR2 Patch Level 2 and were advised to update to Patch Level 3 to fix a minor glitch in SSL VPN web access. Unfortunately it seems that Patch Level 3 wrecks something performance-wise ... since the upgrade we' ve been getting sites not loading (at all), sites partially loading, SSL certificate errors, and so on. We' ve now downgraded back to v4.0 MR2 Patch Level 2 and the performance issues have gone away...