Fortinet Gate 60D, Руководство администратора

Страница: 625 / 706

WAN optimization and web caching SSL offloading for WAN optimization and web caching
FortiGate Version 4.0 Administration Guide
01-400-89802-20090424
625
http://docs.fortinet.com/ • Feedback
A number of SSL offloading configurations are possible. This section includes two.
Example configuration: SSL offloading for a WAN optimization tunnel
In this example, clients on a client network use https://192.168.10.20 to browse to a web
server. A WAN optimization rule with
Auto-Detect set to Off on the client side FortiGate
unit accepts sessions from the clients with source addresses on the 172.20.120.0 network
and with a destination address of 192.168.10.0 and with a destination port of 443. In this
rule
Enable secure tunnel is selected so that the tunnel is encrypted.
The server side FortiGate unit includes an SSL server configuration with
ip
set to
192.168.10.20 and
port
to 443. The server side FortiGate unit also includes the web
server CA.
Figure 421: SSL offloading WAN optimization configuration
When the client side FortiGate unit accepts an HTTPS connection for 192.168.10.20 the
SSL server configuration provides the information that the client side FortiGate unit needs
to decrypt the traffic and send it in clear text across a WAN optimization tunnel to the
server side FortiGate unit. The server side FortiGate unit then forwards the clear text
packets to the web server.
The web server CA is not downloaded from the server side to the client side FortiGate
unit. Instead the client side FortiGate unit proxies the SSL parameters from the client side
to the server side which returns an SSL key and other required information to the client
side FortiGate unit so that the client FortiGate unit can decrypt and encrypt HTTPS traffic.
To configure the client side FortiGate unit
1 Go to WAN Opt. & Cache > Peer and enter a Local Host ID for the server side
FortiGate unit.
Note: In this peer-to-peer configuration you do not need to add a WAN optimization rule to
the server side FortiGate unit as long as the server side FortiGate unit includes the Peer
Host ID of the client FortiGate unit in its peer list. However, you could set
Auto-Detect to
Active on the client side FortiGate and add then a passive rule to the server side FortiGate
unit.
Note: In this example the secure tunnel and the authentication group configurations are not
required, but are added to protect the privacy of the WAN optimization tunnel. Instead of
the secure tunnel configuration, you could configure a route-based IPSec VPN between the
FortiGate units and use IPSec to protect the privacy of the WAN optimization tunnel.
Client Network
172.20.120.0
WAN
Encrypted
Traffic
Decrypted
Traffic
Decrypted
Traffic
Protected by the
Encrypted tunnel
Web Server
(port 80)
IP:192.168.10.20
Server side
SSL server and Web server CA
Local Host ID:Web_servers
Client side
Rule: autodetect: off
Local Host ID:User_net
3 1
2
3 1
2
3 1
2
IP address
172.20.120.1
IP address
192.168.10.1