[PDF] FortiWeb Administration Guide 14 wrz 2020 SSL offloading

View - Download FortiWeb Administration Guide

Previous PDF

Next PDF

Switch

FortiGate

Protected Web

ServersAdministratorFortiWeb

Client

Login View

Set-Cookie: name=cookiesession1...

Cookie: name=cookiesession1...

FortiWeb AFortiWeb B

FortiWeb HA pair

Standby

Active

Login View

ModifyFailover

Set-Cookie: name=cookiesession1...

Cookie: name=cookiesession1...

Cookie: name=cookiesession1...

Cookies accepted

though sessions are not synchronizedActive

Standby

XML attacksFlash, XSS, SQL injection

IP spoongViruse

s

FortiGate + FortiWeb

FortiWeb

10.0.2.1

port2192.0.2.1 port3Web

Server 1

Web

Server 2

Client

10.0.2.200

FortiADC

FortiWeb Sees

HTTP ClientÕs IP

Block 10.0.2.200?

10.0.2.1

port2192.0.2.1 port3 Web

Server 1

Web

Server 2

Client

10.0.2.200

FortiADC

SNAT Hides

HTTP ClientÕs IP

192.0.2.2

port2172.0.2.1 port3

FortiWeb

Block 192.0.2.1?

10.0.2.1

port2192.0.2.1 port3 Web

Server 1

Web

Server 2

Client

10.0.2.200

FortiADC

FortiWeb Sees

HTTP ClientÕs IP

192.0.2.2

port2172.0.2.1 port3

GET /index.php

X-Real-IP:

10.0.2.200,192.0.2.1

FortiWeb

Block 10.0.2.200?

FortiWeb

10.0.2.1

port2port3

192.0.2.1

Switch

192.0.2.2/24

192.0.2.3/24

Web

Server 1

Web

Server 2

Client

FortiGate

port3

192.0.2.2HTTP

Only

HTTP &

SFTP SFTP

Scanned

HTTP

FortiGateClient

port2

10.0.2.1port3192.0.2.1

192.0.2.3/24

Web

Servers

FortiWeb

OE

FortiWeb

192.168.1.1/24

LAN port1

172.16.1.10/24port3

(bridge1)port4 (bridge1)

Client

Administrator

LALAN

FortiGate

Switch

192.168.1.4/24

Web

Server 2

192.168.1.3/24

Web

Server 1

FortiWeb

192.168.1.1/24

port2

Switch

192.168.1.3/24

192.168.1.4/24

Web

Server 1

Web

Server 2

Client

FortiGate

FortiWeb resets TCP

connection if it detects policy violation

FortiWeb

port3

172.22.80.1/24

port3

172.22.80.100/24

Client

FortiGate

Switch

192.168.1.5/24

Web

Server 2

192.168.1.4/24

Web

Server 1

HTTP and HTTPS

Scanned

HTTP and

HTTPS non-HTTP port1 port2

192.168.1.1/24

FortiGate

Servers

Clients

Switch

To fail over, standby sends

gratuitous ARP

OE. This causes

network to transfer all FortiWeb

VMAC & IP addresses to

ports linked to standby

10.0.0.1

10.0.1.1

10.0.2.1

port1

FortiWeb HA pair

port3 port4

Standby

192.168.1.1

port2

192.168.1.2-4

Heartbeat

Links

OE arp reply 10.0.0.1

is-at 00:09:0f:09:00:00 (00:09:0f:09:00:00) arp reply 10.0.1.1 is-at 00:09:0f:09:00:00 (00:09:0f:09:00:00) arp reply 10.0.2.1 is-at 00:09:0f:09:00:00 (00:09:0f:09:00:00)arp reply 192.168.1.1is-at 00:09:0f:09:00:02(00:09:0f:09:00:02) port2port1 vserver1 vserver2Active (Failed) port1

FortiWeb

transparent proxy

FortiWeb

transparent proxy

FortiADC

192.168.1.1

port2

Client

Switch

192.168.1.2/24

192.168.1.3/24

quotesdbs_dbs5.pdfusesText_9

[PDF] how to improve english speaking skills free pdf download

[PDF] how to improve performance of java application

[PDF] how to improve presentation skills pdf

[PDF] how to insert data in specific column in sql

[PDF] how to insert data into table

[PDF] how to know the size of array java

[PDF] how to learn formal languages and automata theory

[PDF] how to make 2 formalin

[PDF] how to make a map in google earth pro

[PDF] how to make a triangle symbol on mac

[PDF] how to make an element constructor in minecraft

[PDF] how to make angle symbol on mac

[PDF] how to make antidote in minecraft

[PDF] how to make chlorine in minecraft

[PDF] how to make foreign letters on keyboard mac