Helpful ReplyHot!HTTP to HTTPS redirect

Author
Pavel
New Member
  • Total Posts : 5
  • Scores: 0
  • Reward points: 0
  • Joined: 2014/09/27 18:01:22
  • Status: offline
2014/09/27 18:12:24 (permalink)
0

HTTP to HTTPS redirect

Good day to everyone!

I faced a real problem with publishing sites with my Fortigate 100D. I have a web-server that published with http port 80. I need to redirect all http trafic to https. We are migrating from Forefront TMG and there I could do this by adding aditional listener on the 443 port and redirecting whole traffic to it. Can I do this with Fortigate 100D? Well actually there is no problem with publishing 80 port by VIPs but I have no idea how to redirect it.. I' ve tried everything but it doesn' t works... Please, help me!
#1
emnoc
Expert Member
  • Total Posts : 5387
  • Scores: 353
  • Reward points: 0
  • Joined: 2008/03/20 13:30:33
  • Location: AUSTIN TX AREA
  • Status: offline
RE: HTTP to HTTPS redirect 2014/09/28 06:09:15 (permalink)
0
Can' t you just create to vips or port-forward for 80 & 443? So when the client initially connects to http://x.x.x.x:80 and get' s the 3XX redirection, h automatically connects at https://x.x.x.x:443 or whatever port in the redirection.

Just ensure you craft your firewall-policies for the correct service/ports for the VIP.


PCNSE 
NSE 
StrongSwan  
#2
ejhardin
Gold Member
  • Total Posts : 438
  • Scores: 12
  • Reward points: 0
  • Joined: 2007/09/22 20:30:02
  • Location: Pacific Northwest
  • Status: offline
RE: HTTP to HTTPS redirect 2014/09/28 10:04:53 (permalink)
5 (1)
The web server would have to do the redirect as the fortigate is not able to switch protocols. It will open ports but will not move traffic from one protocol to another. You need a FortiWeb or have the web server issue a redirect.
#3
Pavel
New Member
  • Total Posts : 5
  • Scores: 0
  • Reward points: 0
  • Joined: 2014/09/27 18:01:22
  • Status: offline
RE: HTTP to HTTPS redirect 2014/09/28 23:31:38 (permalink)
0
Thanks for your feedback! Now I see, my Fortigate just don' t have ssl acceleration... So sad. Wiil try to resolve it somehow. Anyway thanks again!
#4
Istvan Takacs_FTNT
Silver Member
  • Total Posts : 118
  • Scores: 15
  • Reward points: 0
  • Joined: 2014/08/05 16:14:08
  • Location: Nowhere, OK
  • Status: offline
RE: HTTP to HTTPS redirect 2014/09/28 23:48:11 (permalink)
0
What do you mean ' no ssl acceleration' ? The 100D comes with a CP8 ASIC that does SSL processing. Suggest to run the following commands to double-check;

get hardware status
Model name: FortiGate-100D
ASIC version: CP8
........


get vpn status ssl hw-acceleration-status



But as previously was mentioned what you want to achieve has nothing to do with Fortigate SSL acceleration.
What you need is a simple VIP object that delivers the port 80 connection requests to port 443 on your web server. e.g

show firewall vip
edit " vip-web-server_HTTPS"
set extip <public IP of the web server>
set extintf " WAN1"
set portforward enable
set mappedip <private IP of the web server>
set extport 80
set mappedport 443
next
#5
AndreaSoliva
Expert Member
  • Total Posts : 248
  • Scores: 78
  • Reward points: 0
  • Joined: 2014/02/10 05:41:00
  • Status: offline
RE: HTTP to HTTPS redirect 2014/09/30 05:56:46 (permalink)
4 (1)
Hi

I suggest following. Go to your FortiGate Support Account and/or Partner Account. Look and/or Search for following document:

How to configure TMG features on FortiGate

There is a FortiGate document which explains how to transfer this stuff of configuration. What you like to to is actually a reverse proxy on a fortigate. On such configuration is possible to have outside https teriminating on FGT and FGT does SSL offloading and forward the traffic to the server by http etc. Also ActivSynch implementation are step by step explaind.

Have a try

hope this helps

have fun

Andrea
#6
Christopher McMullan_FTNT
Platinum Member
  • Total Posts : 415
  • Scores: 36
  • Reward points: 0
  • Joined: 2014/09/08 08:00:33
  • Status: offline
RE: HTTP to HTTPS redirect 2014/09/30 06:06:36 (permalink)
5 (1)
It sounds like the initial connection needs to be made over port 80 and connect to the server on port 443, not the reverse.

My knowledge usually only expands through training, helping others with their tickets, or when someone calls in because something is wrong (no one calls in when everything works!)

All that being said, a VIP used as a virtual server for a reverse proxy can be set with ssl-mode full or half.

Full encrypts both legs (client > FortiGate and FortiGate > server). Half encrypts the client > FortiGate portion. In both cases, unless I' m missing something, you still need the client to target port 443 on the FortiGate.

Please feel free to pile on if there are exceptions. The CLI reference for OS 5.0 details this under ' config firewall vip' on page 228.

Regards,
Chris McMullan
Fortinet Ottawa
#7
Pavel
New Member
  • Total Posts : 5
  • Scores: 0
  • Reward points: 0
  • Joined: 2014/09/27 18:01:22
  • Status: offline
RE: HTTP to HTTPS redirect 2014/10/05 22:49:15 (permalink)
0
Huge thanks for your feedback!!! All your posts were helpfull!

The problem was with firmware (I have a virtual WAN with 3 physical caonnections from 2 IPS). After upgrading to v 5.2.1 ssl offloading started to work fine. And then Cristopher McMullans post helped me with ssl-http-location conversion! So thanx to you all guys! And sorry for late reply!
#8
DW_FTNT
New Member
  • Total Posts : 7
  • Scores: 2
  • Reward points: 0
  • Joined: 2019/08/12 07:38:28
  • Status: offline
Re: HTTP to HTTPS redirect 2019/08/12 08:51:51 (permalink) ☄ Helpfulby AtiT 2019/08/16 01:50:04
5 (1)
HTTP to HTTPS redirect was added to 6.2.1 Code
 
you can terminate 443 on the fortigate or just pass 443 all the way to the server.
This link shows how to terminate/offload 443 on the fortigate
https://docs.fortinet.com/document/fortigate/6.2.0/cookbook/304594/http-to-https-redirect-for-load-balancing
here is a link to offloading
https://help.fortinet.com/fos50hlp/54/Content/FortiOS/fortigate-load-balancing-52/ldb-ssl-tls-offload.htm
 
 
if you want to just pass 443 to the server and not terminate the session on the fortigate
edit the vip
"virtual-server-https"
--->  set server-type tcp
 
we can  redirect other ports like 8080  using http
edit "virtual-server-http"
    set extport 80
to
   set extport 8080
 
 
be sure to use proxy mode
#9
Jump to:
© 2019 APG vNext Commercial Version 5.5