SD-WAN Intf as srcintf on Transparent Proxy

Author
Veldrin
New Member
  • Total Posts : 2
  • Scores: 0
  • Reward points: 0
  • Joined: 2017/03/18 02:39:44
  • Status: offline
2020/10/27 15:29:32 (permalink)
0

SD-WAN Intf as srcintf on Transparent Proxy

Hi Community,
 
I recently started messing with SD-WAN in my home-lab. As my Lab setup heavily relies on zones (simplifies ruleset management) and I dod not want that SD-WAN Interfaces disrupt my design, I came up with the glorious idea of adding also internal interfaces to the SD-WAN zone. 
 
Turns out, this works great as long as only firewall rules are involved, and some quirks around Multicast Rules and Central NAT (needs plain interface) works as expected. 
 
The only trouble I found was the transparent proxy (i.e. using firewall with http(s) redirect and Proxy policy in transparent proxy mode), I did not get any rule hits (in the proxy policy). Changing the source interface to any return the functionality, but at loss of some security. (there is a reason, why FortiGate is a zone based firewall)
 
Alternatively disabling the http(s) redirect on the firewall policy, and use flow based security policy works as well. 
 
But I am a fan of neither. 
Question: Am I mis-using SD-WAN for a setup that is was never intended? of did I hit (another) FortiBug?
 
PS. for the destination Interface, an SD-WAN interface can be used. the issue only appears, if the source interface is a SD-WAN Interface. 
 
PPS. FG61E with 6.4.3
#1

0 Replies Related Threads

    Jump to:
    © 2020 APG vNext Commercial Version 5.5