AnsweredHot!Server load balancing - redirect HTTP to HTTPS

Author
slavko
Silver Member
  • Total Posts : 83
  • Scores: 6
  • Reward points: 0
  • Joined: 2014/08/09 01:05:35
  • Location: Montenegro
  • Status: offline
2015/03/06 09:13:21 (permalink)
0

Server load balancing - redirect HTTP to HTTPS

Hi guys,
 
I've set up a 100D to load balance HTTPS traffic between two real servers. So, I have one virtual server of type HTTPS, SSL offloading Client<->FortiGate and two real servers. But the problem is that users have to type in https://www.webserveraddress.dom every time they want to access my website.
 
What I would like is to automatically redirect their HTTP requests (i.e. http://www.webserveraddress.dom) to HTTPS (i.e. https://www.webserveraddress.dom).
 
Is there any way to do this on FGT-100D?
 
Thanks!
post edited by slavko - 2015/03/07 03:14:54

NSE 4, NSE 5, NSE 7, FortiMail & FortiWeb Specialist
All oppinions/statements written here are my own.
#1
garyxd
New Member
  • Total Posts : 13
  • Scores: 0
  • Reward points: 0
  • Joined: 2014/03/07 11:53:34
  • Status: offline
Re: Server load balancing - HTTP to HTTPS 2015/03/06 22:20:24 (permalink)
0
I think you need a FortiWeb for this case.  Or other dedicated load balancer (F5, A10, Kemp, etc.) / WAF that supports SSL offloading.
#2
slavko
Silver Member
  • Total Posts : 83
  • Scores: 6
  • Reward points: 0
  • Joined: 2014/08/09 01:05:35
  • Location: Montenegro
  • Status: offline
Re: Server load balancing - HTTP to HTTPS 2015/03/07 02:45:00 (permalink)
0
Hi,
FortiGate-100D does support SSL Offloading, and I've created a virtual server of HTTPS type. This works great. The certificate is being presented to the client by the FGT (SSL offloading is Client<->FortiGate), and the connections are being load balanced between two real servers.
 
But, it works only if the client types in https://www.serveraddres.lab in the address bar. If they go to the http://www.serveraddress.lab, they get nothing.
 
What I would like is that FortiGate automatically redirects all clients from http to https. It is a simple thing to do in TMG.

NSE 4, NSE 5, NSE 7, FortiMail & FortiWeb Specialist
All oppinions/statements written here are my own.
#3
Dinesh_FTNT
New Member
  • Total Posts : 8
  • Scores: 0
  • Reward points: 0
  • Joined: 2015/02/02 02:54:43
  • Status: offline
Re: Server load balancing - redirect HTTP to HTTPS 2015/03/09 08:35:47 (permalink) ☼ Best Answerby slavko 2015/03/09 14:33:18
0
HI,
Your requirement can be achieved with Fortiweb but with Fortigate HTTP to HTTPS redirection is not possible.
#4
slavko
Silver Member
  • Total Posts : 83
  • Scores: 6
  • Reward points: 0
  • Joined: 2014/08/09 01:05:35
  • Location: Montenegro
  • Status: offline
Re: Server load balancing - redirect HTTP to HTTPS 2015/03/09 14:33:04 (permalink)
0
OK, thank you... It's a shame, really. It's only a minor feature, and I don't think it would be hard to implement, too. Especially when you consider that FGT is perfectly capable to automatically redirect administrative users from HTTP to HTTPS, when they try to login.
 
Thanks anyway, it's a correct answer - even though I don't like it. :)
 

NSE 4, NSE 5, NSE 7, FortiMail & FortiWeb Specialist
All oppinions/statements written here are my own.
#5
DW_FTNT
New Member
  • Total Posts : 7
  • Scores: 2
  • Reward points: 0
  • Joined: 2019/08/12 07:38:28
  • Status: offline
Re: Server load balancing - redirect HTTP to HTTPS 2019/08/12 09:00:44 (permalink)
0
HTTP to HTTPS redirect was added to 6.2.1 Code
 
you can terminate 443 on the fortigate or just pass 443 all the way to the server.
This link shows how to terminate/offload 443 on the fortigate
https://docs.fortinet.com...ect-for-load-balancing
here is a link to offloading
https://help.fortinet.com...db-ssl-tls-offload.htm
 
 
if you want to just pass 443 to the server and not terminate the session on the fortigate
edit the vip
"virtual-server-https"
--->  set server-type tcp
 
you can also redirect other ports like 8080  using http
edit "virtual-server-http"
    set extport 80
to
   set extport 8080
 
 
be sure to use proxy mode
#6
Jump to:
© 2019 APG vNext Commercial Version 5.5