Example Configuration: Ssl Offloading For A Wan Optimization Tunnel - Fortinet Gate 60D Administration Manual

WAN optimization and web caching

Example configuration: SSL offloading for a WAN optimization tunnel

FortiGate Version 4.0 Administration Guide
01-400-89802-20090424
http://docs.fortinet.com/ • Feedback
A number of SSL offloading configurations are possible. This section includes two.
In this example, clients on a client network use https://192.168.10.20 to browse to a web
server. A WAN optimization rule with Auto-Detect set to Off on the client side FortiGate
unit accepts sessions from the clients with source addresses on the 172.20.120.0 network
and with a destination address of 192.168.10.0 and with a destination port of 443. In this
rule Enable secure tunnel is selected so that the tunnel is encrypted.
The server side FortiGate unit includes an SSL server configuration with ip set to
192.168.10.20 and port to 443. The server side FortiGate unit also includes the web
server CA.
Figure 421: SSL offloading WAN optimization configuration
Client Network
Client side
172.20.120.0
Rule: autodetect: off
Local Host ID:User_net
Encrypted
Traffic
3 1
2
When the client side FortiGate unit accepts an HTTPS connection for 192.168.10.20 the
SSL server configuration provides the information that the client side FortiGate unit needs
to decrypt the traffic and send it in clear text across a WAN optimization tunnel to the
server side FortiGate unit. The server side FortiGate unit then forwards the clear text
packets to the web server.
The web server CA is not downloaded from the server side to the client side FortiGate
unit. Instead the client side FortiGate unit proxies the SSL parameters from the client side
to the server side which returns an SSL key and other required information to the client
side FortiGate unit so that the client FortiGate unit can decrypt and encrypt HTTPS traffic.
Note: In this peer-to-peer configuration you do not need to add a WAN optimization rule to
the server side FortiGate unit as long as the server side FortiGate unit includes the Peer
Host ID of the client FortiGate unit in its peer list. However, you could set Auto-Detect to
Active on the client side FortiGate and add then a passive rule to the server side FortiGate
unit.
Note: In this example the secure tunnel and the authentication group configurations are not
required, but are added to protect the privacy of the WAN optimization tunnel. Instead of
the secure tunnel configuration, you could configure a route-based IPSec VPN between the
FortiGate units and use IPSec to protect the privacy of the WAN optimization tunnel.
To configure the client side FortiGate unit
1 Go to WAN Opt. & Cache > Peer and enter a Local Host ID for the server side
FortiGate unit.
SSL offloading for WAN optimization and web caching
SSL server and Web server CA
Local Host ID:Web_servers
WAN
IP address
IP address
172.20.120.1
192.168.10.1
3 1
2
Server side Web Server
(port 80)
IP:192.168.10.20
Decrypted
Traffic
3 1
2
625