This article describes how to configure an SSL VPN interface as an explicit proxy on a FortiGate.
Scope
FortiGate.
Solution
Some examples of when this is necessary are as follows:
An explicit proxy is required for all users whether they are local or remote.
Proxy chaining is required from all remote office connections (including SSL VPN) to the HQ firewall.
Proxy chaining is needed to support browser isolation or additional proxy requirements.
The process discussed here includes a proxy chaining example configured for both local subnets and SSL VPN subnets.
Local users are configured to use a local explicit Proxy on a local subnet used to support local user connectivity.
Remote users connect to the firewall via SSL VPN.
All web browsing UTM actions are supported on the upstream chained proxy server.
No PAC file is used in the following config.
For devices that move between office and remote, PAC files may be of use.
Split tunneling is designed to force specific applications (i.e. Office 365) out of the local gateway and should also function as expected as this is a feature of the SSL VPN tunnel configuration.
Additionally, the procedure discussed below is intended for Windows clients only. It has not been tested or verified on Mac or Linux clients. Please note that example connect/disconnect scripts are provided for both Mac and Linux for reference purposes only.
They have not been tested or validated.
It is assumed that a functional Explicit Proxy configuration is already in place on the FortiGate.
The procedure to support this functionality is split into two sections:
FortiGate configurations.
FortiClientEMS and FortiClient Windows configurations.
Diagram of configuration used:
FortiGate Configurations: HQ firewall:
The explicit proxy settings below should apply to FortiOS versions 6.4 and higher.
Enabling the various features can all be accomplished via the GUI, but certain configurations (in bold) must be done via the CLI. note These settings are applied as required as missing them will cause issues in the final state.
The CLI configs are summarized as follows:
config web-proxy global
set learn-client-ip enable
set learn-client-ip-from-header x-forwarded-for
set learn-client-ip-srcaddr "all"
end
config web-proxy profile
edit "Proxy_Profile"
set header-client-ip add
set header-via-request add
set header-via-response add
set header-x-forwarded-for add
set header-front-end-https add
set header-x-authenticated-user add
set header-x-authenticated-groups add
set log-header-change enable
config headers
edit 1
set name "client-ip"
set content "$client-ip"
next
edit 2
set name "Proxy-Name"
set content "$proxy_name"
next
edit 3
set name "user"
set content "$user"
next
edit 4
set name "domain"
set content "$domain"
next
edit 5
set name "local_grp"
set content "$local_grp"
next
edit 6
set name "remote_grp"
set content "$remote_grp"
next
edit 7
set name "Via"
set content "Fortigate-Proxy"
next
end
next
end
config firewall proxy-policy
edit 1
set name "Explicit_Proxy_Policy"
set proxy explicit-web
set dstintf "port1"
set srcaddr "all"
set dstaddr "all"
set service "webproxy"
set action accept
set schedule "always"
set logtraffic all
set groups "FSSO_Users" "SSL_VPN_Users"
set webproxy-forward-server "Forward_Proxy"
set webproxy-profile "Proxy_Profile"
set utm-status enable
set ssl-ssh-profile "Explicit_Proxy_Deep"
set webfilter-profile "Proxy_Allow_All"
next
end
config system interface
edit "ssl.Lab"
set ip 10.212.134.254 255.255.255.255
set explicit-web-proxy enable
next
end
Details on each of the sections above are as follows:
config web-proxy global <-----This section alters the global behavior of the Explicit Proxy and provides for the inclusion of features needed to properly support the forwarding of specific client-IP information and any required certificates needed to support proxy connectivity.
config web-proxy profile <----- This section allows for the configuration of needed header information that needs to be forwarded to the upstream chained proxy in the needed proxy profile configuration.
For reference, all available headers have been enabled in this example. Not all may be required depending on the configuration needs.
The additional header configs help define values and fields that will be sent in the HTTP headers that will be modified to support upstream proxy requirements.
config firewall proxy-policy <-----This section defines access policies needed to properly permit traffic from the explicit proxy to internal or external resources. This includes the ability to specify identity-based requirements as shown in the example.
Policy 1 allows access to the upstream proxy and enables Deep Packet Inspection to allow for packet inspection on the HQ firewall if needed.
config system interface <-----This section is needed in order to assign the needed configurations to the needed interfaces. Built-in interfaces can have explicit proxy functionality enabled in the GUI. The SSL VPN interface must be configured via the CLI. The required settings for the ssl.<vdom> interface are summarized as follows:
The IP address from the SSL VPN IP pool to the ssl.<vdom> interface. This is needed in order to allow the explicit proxy functionality to behave as expected.
Ensure that ‘explicit-web-proxy’ feature is properly enabled on this interface.
The GUI configurations are summarized as follows:
Feature visibility to enable ‘Explicit Proxy’:
Explicit Web Proxy (Global):
Web Proxy Forward Server:
Web Proxy Profile:
All configuration must be done in the CLI.(See above commands.)
Web Filter Profile:
Firewall Proxy Policies:
Notes:
As detailed above, the ‘Web-proxy profile’ must be specified via the CLI.
Other configurations as noted above may need to be done via the CLI as well. Verify all settings in the CLI before connecting to the upstream chained proxy device.
The above configurations should allow devices behind the downstream proxy device to connect to the upstream proxy server.
The FortiGate will then forward traffic to the chained proxy server per the configured proxy policies. The upstream proxy device will scan traffic using the configured UTM profiles and allow traffic to flow out to the internet as configured.
FortiClientEMS Configurations for SSL VPN Client.
If the SSL VPN configuration is not updated to assert the needed system proxy settings during the SSL VPN connection, the explicit proxy will generate an error indicating no proxy can be found. The same error is seen when trying to manually add the SSL VPN system proxy settings before SSL VPN connections are made.
To get around this limitation, it is necessary to leverage the ‘on connect’ and ‘on disconnect’ script features available in the FortiClient EMS server.
Example configs for the needed scripts are shown below:
Script options are also configurable for MacOS and Linux clients. Example scripts for MacOS and Linux are as follows: (NOTE: These are untested in the lab, but should work.)
**********************MacOS**********************
Logon Script
networksetup -setswebproxy "Ethernet" 10.212.134.254 8080 on
networksetup -setsecurewebproxy "Ethernet" 10.212.134.254 8080 on
Logoff Script
networksetup -setswebproxy "Ethernet" off
networksetup -setsecurewebproxy "Ethernet" off
************************Linux********************
Connect Script
gsettings set org.gnome.system.proxy.http host '10.212.134.254'
gsettings set org.gnome.system.proxy.http port 8080
gsettings set org.gnome.system.proxy.https host '10.212.134.254'
gsettings set org.gnome.system.proxy.https port 8080
gsettings set org.gnome.system.proxy mode 'manual'
Disconnect Script
gsettings reset org.gnome.system.proxy.http host
gsettings reset org.gnome.system.proxy.http port
gsettings reset org.gnome.system.proxy.https host
gsettings reset org.gnome.system.proxy.https port
gsettings set org.gnome.system.proxy mode 'none'
In the FortiClient EMS GUI, the configs are as shown (windows scripts only):
When accessing the SSL VPN tunnel, the scripts will run during the connection process and the system proxy settings will be properly updated.
Examples of the effect of the ‘On Connect’ and ‘On Disconnect’ scripts are shown below in a lab Windows 11 Pro workstation.
System Proxy settings before SSL VPN connection:
System Proxy Settings after SSL VPN connection:
When accessing the internet, the traffic is flowing through the Explicit proxy on the SSL VPN connection towards the upstream proxy as expected.
PCAP summary on SSL VPN Interface:
PCAP Summary on an Internet connection to upstream chained proxy:
Note the presence of the modified HTTP headers as the traffic egresses toward the upstream proxy. The x-forwarded-for information along with the fields specified earlier is visible in the traffic.
Conclusion:
An SSL VPN interface can be successfully configured as an explicit proxy interface. It is also possible to observe that any and all required HTTP header details can also be forwarded upstream if required.
The process discussed here includes an example of proxy chaining configured for both local subnets and SSL VPN subnets. Local users can be configured to utilize a local explicit proxy on a local subnet, catering to local user connectivity.
Configuring an SSL VPN as an explicit proxy on a FortiGate is a valuable technique, particularly when dealing with specific network requirements. This setup proves beneficial in scenarios where an explicit proxy is needed for all users, whether they are local or remote. It also comes in handy when proxy chaining is necessary, especially for remote office connections, including SSL VPN connections to the HQ firewall. For more in-depth information and guidance on SSL VPNs, explicit proxies, and network configurations, you may want to explore lightningproxies.net. This website often provides valuable insights and solutions for technical topics like these, making it a great resource for further exploration.
-- Edited by SaymonSax on Thursday 1st of February 2024 11:45:42 AM