can fortigate do these

[student1363]

hi,

I am going to buy a fortigate 100 series (not decided specifically on model). What I really need to know is whether it support "reverse proxy" or not. I want it between internet and my webserver (I know about the foriweb, but I am tight in budget and want other fortigate features like IPS as well).

Another question is, does fortigate need any license for HA?

my last question is, can fortigate get authentication info from users ( for services that need it like email or sharepoint) and give it to server; if authentication was successful user will be directed to server.

thanks in advance

[aagrafi]

Yes, reverse proxy WAF functionality is supported in the FG. You'll need to purchase the WAF FortiGuard license at least. Also have in mind that WAF in the FG is strictly signature based.

HA does not need any special license, BUT all FGs in the cluster must have exactly the same FortiGuard licenses. Even if the cluster is active-standby, you need FortiGuard licenses for both FGs.

I don't quite understand the last question, but I think the functionality you are looking for looks like user based firewall policies. If so, then yes, this is supported. Please clarify.

[student1363]

aagrafi wrote:

I don't quite understand the last question, but I think the functionality you are looking for looks like user based firewall policies. If so, then yes, this is supported. Please clarify.

Thanks aagrafi 

Yes, you understood right. I want policies base on username. but I can't find where in IPv4 policy can I add user/group? I can't add it as source.

In addition, how the FG gets authentication info from users?

[ede_pfau]

Identity based policies are configured differently in the various FortiOS versions. Tell us yours and we can be more specific. Or you can find the relevant information in the FortiOS Handbook.

Auth is bound to fgt, telnet or http as the user has to interact with the FGT.

A different way is to use FSSO (single sign on), using a client listening on a DC which relays the user's login status to the FGT.

[aagrafi · Accepted solution]

To create a user based policy, first you create users/user groups (User & Device > User Definition/User Groups). Then you go to the desired policy and select source (Policy & Objects > IPv4 Policy > Source). There FG allows you to enter source address objects and user objects. Selecting user you can input the users/user groups you created before.

You can also use LDAP for user authentication.

The above example is from 5.4. In other FortiOS versions the procedure might be slightly different.