wanopt
Use these commands to configure FortiGate WAN optimization.
auth-group
settings
peer
profile
ssl-server
storage
webcache
Page 835
wanopt
auth-group
auth-group
Use this command to configure WAN optimization authentication groups. Add authentication groups to support authentication and secure tunneling between WAN optimization peers.
Syntax
config wanopt auth-group
edit <auth_group_name> set auth-method {cert | psk} set cert <certificate_name> set peer <peer_host_id> set peer-accept {any | defined | one}
end
set psk <preshared_key>
Variable Description
edit <auth_group_name> Enter a name for the authentication group.
auth-method {cert | psk} Specify the authentication method for the authentication group. Enter cert to authenticate using a certificate. Enter psk to authenticate using a preshared key.
cert <certificate_name>
If auth-method is set to cert, select the local certificate to be used by the peers in this authentication group. The certificate must be a local certificate added to the FortiGate unit using the config vpn certificate local
command. For more information, see “vpn certificate local” on page 760 .
peer <peer_host_id> peer-accept
{any | defined | one}
If peer-method is set to one select the name of one peer to add to this authentication group. The peer must have been added to the FortiGate unit using the config wanopt peer command.
Specify whether the authentication group can be used for any peer, only the defined peers that have been added to the FortiGate unit configuration, or just one peer. If you specify one use the peer field to add the name of the peer to the authentication group.
psk <preshared_key>
If auth-method is set to psk enter a preshared key to be used for the authentication group.
Default
cert any
Fortinet Technologies Inc.
Page 836 FortiOS™ - CLI Reference for FortiOS 5.0
wanopt
peer
peer
Add WAN optimization peers to a FortiGate unit to identify the FortiGate units that the local
FortiGate unit can form WAN optimization tunnels with. A peer consists of a peer name, which is the local host ID of the remote FortiGate unit and an IP address, which is the IP address of the interface that the remote FortiGate unit uses to connect to the local FortiGate unit.
Use the command config wanopt settings to add the local host ID to a FortiGate unit.
Syntax
config wanopt peer
edit <peer_name>
end
set ip <peer_ip_ipv4>
Variable Description
edit <peer_name> Add the local host ID of the remote FortiGate unit. When the remote FortiGate unit connects to the local FortiGate unit to start a WAN optimization tunnel, the WAN optimization setup request include the remote FortiGate unit local host ID. If the local host ID in the setup request matches a peer added to the local FortiGate unit, then the local FortiGate unit can accept
WAN optimization tunnel setup requests from the remote
FortiGate unit.
ip <peer_ip_ipv4> Enter the IP address of the interface that the remote FortiGate unit uses to connect to the local FortiGate unit. Usually this would be the IP address of the interface connected to the
WAN.
Default
0.0.0.0
Fortinet Technologies Inc.
Page 837 FortiOS™ - CLI Reference for FortiOS 5.0
wanopt
profile
profile
WAN optimization uses profiles to select traffic to be optimized. But, before WAN optimization can accept traffic, the traffic must be accepted by a FortiGate firewall policy. All sessions accepted by a firewall policy that also match a WAN optimization profile are processed by WAN optimization.
To configure WAN optimization you add WAN optimization profiles to the FortiGate units at each end of the tunnel. Firewall policies use the specified WAN optimization profile to determine how to optimize the traffic over the WAN.
The FortiGate unit applies firewall policies to packets before WAN optimization profiles. A WAN optimization profile is applied to a packet only after the packet is accepted by a firewall policy.
Syntax
config wanopt profile
edit <name_str> set auth-group <auth_group_name>
set transparent {enable | disable}
config {cifs | ftp | http | mapi | tcp} set
byte-caching {enable | disable}
set
byte-caching-opt {mem-only | mem-disk}
set
log-traffic {enable | disable}
set
port <port_int>[-<port-int>]
set
prefer-chunking {fix | dynamic}
set
secure-tunnel {enable | disable}
set
ssl {enable | disable}
set
status {enable | disable}
set
tunnel-non-http {enable | disable}
set
tunnel-sharing {express-shared | private | shared}
set
unknown-http-version {best-effort | reject | tunnel}
end
Variable Description
edit <name_str>
Enter a name for this profile.
auth-group <auth_group_name> Select an authentication group to be used by this profile. Select an authentication group if you want the client and server FortiGate units that use this profile to authenticate with each other before starting a WAN optimization tunnel.
Default
You must add the same authentication group to the client and server FortiGate units. The authentication group should have the same name of both FortiGate units and use the same preshared key or the same certificate.
You can add an authentication group to profiles with auto-detect set to off or active. An authentication group is required if you enable secure-tunnel for the profile.
Fortinet Technologies Inc.
Page 838 FortiOS™ - CLI Reference for FortiOS 5.0
wanopt profile
Variable
transparent {enable | disable}
Description
Enable or disable transparent mode for this profile.
Default
enable
If you enable transparent mode, WAN optimization keeps the original source address of the packets, so servers appear to receive traffic directly from clients. Routing on the server network should be able to route traffic with client IP addresses to the
FortiGate unit.
If you do not select transparent mode, the source address of the packets received by servers is changed to the address of the FortiGate unit interface. So servers appear to receive packets from the FortiGate unit. Routing on the server network is simpler in this case because client addresses are not involved, but the server sees all traffic as coming from the FortiGate unit and not from individual clients.
config {cifs | ftp | http | mapi | tcp} fields
byte-caching {enable | disable}
Enable or disable WAN optimization byte caching for the traffic accepted by this profile. Byte caching is a WAN optimization technique that reduces the amount of data that has to be transmitted across a WAN by caching file data to serve it later as required. Byte caching is available for all protocols.
byte-caching-opt
{mem-only | mem-disk}
Select whether byte-caching optimization uses only memory or both memory and disk. This is available for TCP only. log-traffic {enable | disable} port <port_int>[-<port-int>]
Enable of disable traffic logging.
Enter a single port number or port number range for the profile. Only packets whose destination port number matches this port number or port number range will be accepted by and subject to this profile.
prefer-chunking {fix | dynamic} Select dynamic or fixed data chunking. Dynamic data chunking helps to detect persistent data chunks in a changed file or in an embedded unknown protocol.
For TCP, disable
For all others, enable mem-only enable
0
Depends on protocol.
prefer-chunking is not available for TCP and MAPI.
For TCP, if byte-caching-opt is mem-disk, chunking algorithm will be dynamic. For MAPI, only dynamic is used. For other protocols, fix is the default.
Fortinet Technologies Inc.
Page 839 FortiOS™ - CLI Reference for FortiOS 5.0
wanopt
Variable Description
secure-tunnel {enable | disable}
Enable or disable using AES-128bit-CBC SSL to encrypt and secure the traffic in the WAN optimization tunnel. The FortiGate units use
FortiASIC acceleration to accelerate SSL decryption and encryption of the secure tunnel.
The secure tunnel uses the same TCP port as a non-secure tunnel (TCP port 7810). ssl {enable | disable} status {enable | disable} tunnel-non-http
{enable | disable}
Default
disable
You can configure securetunnel if autodetect is set to active or off. If you enable secure-tunnel you must also add an authgroup to the profile.
Enable or disable applying SSL offloading for
HTTPS traffic. You use SSL offloading to offload
SSL encryption and decryption from one or more
HTTP servers. If you enable ssl, you should configure the profile to accept SSL-encrypted traffic, usually by configuring the profile to accept
HTTPS traffic by setting port to 443.
If you enable SSL you must also use the config wanopt ssl-server command to add an SSL server for each HTTP server that you wan to offload SSL encryption/decryption for. See
“wanopt ssl-server” on page 843
.
disable
You can configure ssl if auto-detect is set to active or off.
Enable or disable the profile.
Configure how to process non-HTTP traffic when a profile configured to accept and optimize HTTP traffic accepts a non-HTTP session. This can occur if an application sends non-HTTP traffic using an HTTP destination port.
enable disable
Select disable to drop or tear down non-HTTP sessions accepted by the profile.
Select enable to pass non-HTTP sessions through the tunnel without applying protocol optimization, byte-caching, or web caching. TCP protocol optimization is applied to non-HTTP sessions.
You can configure tunnel-non-http if proto is set to http and auto-detect is set to active or off.
profile
Fortinet Technologies Inc.
Page 840 FortiOS™ - CLI Reference for FortiOS 5.0
wanopt
Variable
tunnel-sharing {express-shared
| private | shared} unknown-http-version
{best-effort | reject | tunnel}
Description
Select the tunnel sharing mode for this profile:
Select express-shared for profiles that accept interactive protocols such as Telnet.
Select private for profiles that accept aggressive protocols such as HTTP and FTP so that these aggressive protocols do not share tunnels with less-aggressive protocols.
Select shared for profiles that accept nonaggressive and non-interactive protocols.
Default
private
You can configure tunnel sharing if proto is set to http and auto-detect is set to off.
Unknown HTTP sessions are HTTP sessions that don’t comply with HTTP 0.9, 1.0, or 1.1. Configure unknown-http-version to specify how a profile handles HTTP traffic that does not comply with HTTP 0.9, 1.0, or 1.1.
tunnel
Select best-effort to assume all HTTP sessions accepted by the profile comply with
HTTP 0.9, 1.0, or 1.1. If a session uses a different
HTTP version, WAN optimization may not parse it correctly. As a result the FortiGate unit may stop forwarding the session and the connection may be lost.
Select reject to reject or tear down HTTP sessions that do not use HTTP 0.9, 1.0, or 1.1.
Select tunnel to pass HTTP traffic that does not use HTTP 0.9, 1.0, or 1.1 without applying HTTP protocol optimization, byte-caching, or web caching. TCP protocol optimization is applied to this HTTP traffic.
You can configure unknown-http-version if proto is set to http and auto-detect is set to active or off.
profile
Fortinet Technologies Inc.
Page 841 FortiOS™ - CLI Reference for FortiOS 5.0
wanopt
settings
settings
Use this command to add or change the FortiGate WAN optimization local host ID and to enable traffic logging for WAN optimization and WAN optimization web caching sessions. The local host ID identifies the FortiGate unit to other FortiGate units for WAN optimization. All WAN optimization tunnel startup requests to other FortiGate units include the local host id. The
FortiGate unit can only perform WAN optimization with other FortiGate units that have this local host id in their peer list.
Syntax
config wanopt settings set
host-id <host-id-name_str>
end set
log-traffic {cifs ftp http mapi tcp}
set
tunnel-ssl-algorithm {high | medium | low}
Variable
host-id <host-id-name_str> log-traffic {cifs ftp http mapi tcp}
Description
Enter the local host ID.
Enable WAN optimization and WAN optimization web caching traffic logging for each type of WAN optimization session.
Valid types are: cifs ftp http mapi tcp.
Separate each type with a space. tunnel-ssl-algorithm
{high | medium | low}
Default
default-id
To add or remove an option from the list, retype the complete list as required.
Select the relative strength of encryption accepted for SSL tunnel negotiation. high high encryption allows AES and 3DES.
medium encryption allows AES, 3DES, and RC4.
low encryption allows AES, 3DES, RC4, and DES.
Fortinet Technologies Inc.
Page 842 FortiOS™ - CLI Reference for FortiOS 5.0
wanopt
ssl-server
ssl-server
Use this command to add one or more SSL servers to support WAN optimization SSL offloading. You enable WAN optimization SSL offloading by enabling the ssl field in a WAN optimization rule. WAN optimization supports SSL encryption/decryption offloading for HTTP servers.
SSL offloading uses the FortiGate unit to encrypt and decrypt SSL sessions.The FortiGate unit intercepts HTTPS traffic from clients and decrypts it before sending it as clear text to the HTTP server. The clear text response from the HTTP server is encrypted by the FortiGate unit and returned to the client. The result should be a performance improvement because SSL encryption is offloaded from the server to the FortiGate unit FortiASIC SSL encryption/decryption engine.
You must add one WAN optimization SSL server configuration to the FortiGate unit for each
HTTP server that you are configuring SSL offloading for. This SSL server configuration must also include the HTTP server CA. You load this certificated into the FortiGate unit as a local certificate using the config vpn certification local command and then add the certificate to the SSL server configuration using the ssl-cert field. The certificate key size must be 1024 or 2048 bits. 4096-bit keys are not supported.
You can configure one WAN optimization rule to offload SSL encryption/decryption for multiple
HTTP servers. To do this, the WAN optimization rule source and destination addresses must be configured so that the rule accepts packets destined for all of the HTTP servers that you want offloading for. Then you must add one SSL server configuration for each of the HTTP servers.
Syntax
config wanopt ssl-server
edit <ssl-server-name> set add-header-x-forwarded-proto {enable | disable}
set ip <ssl_server_ip_ipv4> set port <port_int> set ssl-mode {full | half} set ssl-algorithm {low | medium | high} set ssl-cert <certificate_name> set ssl-client-renegotiation {allow | deny | secure} set ssl-dh-bits {1024 | 1536 | 2048 | 768} set ssl-min-version {ssl-3.0 | tls-1.0} set ssl-max-version {ssl-3.0 | tls-1.0}
end
set ssl-send-empty-frags {disable | enable} set url-rewrite {enable | disable}
Variable
edit <ssl-server-name>
Description
Enter a name for the SSL server. It can be any name and this name is not used by other FortiGate configurations.
add-header-x-forwarded-proto
{enable | disable}
Optionally add X-Forwarded-Proto header. This is available when ssl-mode is half.
Default
enable
Fortinet Technologies Inc.
Page 843 FortiOS™ - CLI Reference for FortiOS 5.0
wanopt ssl-server
Variable
ip <ssl_server_ip_ipv4> port <port_int> ssl-mode {full | half}
Description
Enter an IP address for the SSL server. This IP address should be the same as the IP address of the HTTP server that this SSL server will be offloading for. When a session is accepted by a
WAN optimization rule with SSL offloading enabled, the destination IP address of the session is matched with this IP address to select the SSL server configuration to use.
Default
0.0.0.0
Enter a port number to be used by the SSL server.
Usually this would be port 443 for an HTTPS server.
When a session is accepted by a WAN optimization rule with SSL offloading enabled, the destination port of the session is matched with this port to select the SSL server configuration to use.
Configure the SSL server to operate in full mode or half mode. Half mode offloads SSL from the backend server to the server-side FortiGate unit.
0 full
Set the permitted encryption algorithms for SSL sessions according to encryption strength: high ssl-algorithm
{low | medium | high} low — AES, 3DES, RC4, DES medium — AES, 3DES, RC4 high — AES, 3DES ssl-cert <certificate_name>
Select the certificate to be used for this SSL server.
The certificate should be the HTTP server CA used by the HTTP server that this SSL server configuration will be offloading for.
The certificate must be a local certificate added to the FortiGate unit using the config vpn certificate local command. For more
information, see “vpn certificate local” on page 760
.
ssl-client-renegotiation
{allow | deny | secure} ssl-dh-bits {1024 | 1536
| 2048 | 768} ssl-min-version {ssl-3.0
| tls-1.0} ssl-max-version {ssl-3.0
| tls-1.0}
The certificate key size must be 1024 or 2048 bits.
4096-bit keys are not supported.
Select whether client renegotiation is allowed. allow
The deny option aborts any SSL connection that attempts to renegotiate.
The secure option rejects any SSL connection that does not offer an RFC 5746 Secure Renegotiation
Indication.
Select the size of the Diffie-Hellman prime used in
DHE_RSA negotiation. Larger primes may cause a performance reduction but are more secure.
1024
Select the lowest or oldest SSL/TLS version to offer when negotiating. You can set the minimum version to SSL 3.0 or TLS 1.0. TLS 1.0 is more secure that
SSL 3.0.
ssl-3.0
tls-1.0
Select the highest or newest SSL/TLS version to offer when negotiating. You can set the maximum version to SSL 3.0 or TLS 1.0. TLS 1.0 is more secure that SSL 3.0.
Fortinet Technologies Inc.
Page 844 FortiOS™ - CLI Reference for FortiOS 5.0
wanopt ssl-server
Variable
ssl-send-empty-frags {disable
| enable}
Description
Enable or disable sending empty fragments before sending the actual payload. Sending empty fragments is a technique used to avoid cipher-block chaining (CBC) plaintext attacks if the initiation vector (IV) is known. Also called the CBC IV. Some
SSL implementations are not compatible with sending empty fragments. Change ssl-sendempty-frags to disable if required by your SSL implementation.
url-rewrite {enable | disable}
Enable to rewrite Location header of HTTP redirection response(3XX response). This is available when ssl-mode is half.
Default
enable disable
Fortinet Technologies Inc.
Page 845 FortiOS™ - CLI Reference for FortiOS 5.0
wanopt
storage
storage
Use this command to change the size of WAN optimization storages. A storage defines the maximum size of the byte caching or web caching database added to the storage.
Syntax
config wanopt storage
edit <storage_name_str>
end
set size <partition_size_int> set webcache-storage-percentage <int>
Variable
edit <storage_name_str> size <partition_size_int>
Description
Enter the name of a storage configured using the config system storage command. All
FortiGate units with hard disks include a default storage name such as
Internal or ASM.
Enter the size of the partition in Mbytes. The default depends on the partition size.
webcache-storage-percentage <int>
Enter the portion, in percent, of the storage that is used for web cache. Remainder is used for wanopt.
Default
50
Fortinet Technologies Inc.
Page 846 FortiOS™ - CLI Reference for FortiOS 5.0
wanopt
webcache
webcache
Use this command to change how the WAN optimization web cache operates. In most cases the default settings are acceptable. However you may want to change these settings to improve performance or optimize the cache for your configuration.
Syntax
config wanopt webcache set
always-revalidate {enable | disable}
set
always-revalidate {enable | disable}
set
cache-cookie {enable | disable}
set
cache-expired {enable | disable}
set
default-ttl <expiry_time>
set
fresh-factor <fresh_percent>
set
ignore-conditional {enable | disable}
set
ignore-ie-reload {enable | disable}
set
ignore-ims {enable | disable}
set
ignore-pnc {enable | disable}
set
max-object-size <object_size>
end set
max-ttl <expiry_time>
set
min-ttl <expiry_time>
set
neg-resp-time <response_time>
set
reval-pnc {enable | disable}
Variable
always-revalidate
{enable | disable} cache-cookie
{enable | disable} cache-expired
{enable | disable} default-ttl
<expiry_time> fresh-factor
<fresh_percent>
Description
Enable to always to revalidate the requested cached object with content on the server before serving it to the client.
Enable caching of cookies. Typically a HTTP response with a cookie contains data for a specific user, so cookie caching is best not done.
disable disable
Applies only to type-1 objects. When this setting is enabled, type-1 objects that are already expired at the time of acquisition are cached (if all other conditions make the object cachable). When this setting is disabled, already expired type-1 objects become non-cachable at the time of acquisition.
Default
enable
1440
The default expiry time for objects that do not have an expiry time set by the web server. The default expiry time is 1440 minutes (24 hours).
100
Set the fresh factor as a percentage. The default is 100, and the range is 1 to 100. For cached objects that don’t have an expiry time, the web cache periodically checks the server to see if the object has expired. The higher the fresh factor the less often the checks occur.
Fortinet Technologies Inc.
Page 847 FortiOS™ - CLI Reference for FortiOS 5.0
wanopt webcache
Variable
ignore-conditional
{enable | disable} ignore-ie-reload
{enable | disable} ignore-ims
{enable | disable} ignore-pnc
{enable | disable}
Description
Enable or disable controlling the behavior of cache-control header values. HTTP 1.1 provides additional controls to the client over the behavior of caches concerning the staleness of the object. Depending on various Cache-Control headers, the FortiGate unit can be forced to consult the OCS before serving the object from the cache. For more information about the behavior of cache-control header values, see RFC
2616 .
Default
disable
Some versions of Internet Explorer issue Accept / header instead of Pragma nocache header when you select Refresh.
When an Accept header has only the / value, the FortiGate unit treats it as a PNC header if it is a type-N object. enable
When this option is enabled, the FortiGate unit ignores the
PNC interpretation of the Accept: / header.
Be default, the time specified by the if-modified-since (IMS) header in the client's conditional request is greater than the last modified time of the object in the cache, it is a strong indication that the copy in the cache is stale. If so, HTTP does a conditional GET to the Overlay Caching Scheme
(OCS), based on the last modified time of the cached object.
Enable ignore-ims to override this behavior.
Typically, if a client sends an HTTP GET request with a pragma no-cache (PNC) or cache-control nocache header, a cache must consult the OCS before serving the content. This means that the FortiGate unit always re-fetches the entire object from the OCS, even if the cached copy of the object is fresh. disable disable
Because of this, PNC requests can degrade performance and increase server-side bandwidth utilization. However, if ignore-pmc is enabled, then the PNC header from the client request is ignored. The FortiGate unit treats the request as if the PNC header is not present at all.
max-object-size
<object_size>
Set the maximum object size to cache. The default size is
512000 kbytes (512 Mbytes). This object size determines the maximum object size to store in the web cache. All objects retrieved that are larger than the maximum size are delivered to the client but are not stored in the web cache. Range: 1 to
2 147 483 kBytes.
max-ttl <expiry_time> The maximum amount of time an object can stay in the web cache without checking to see if it has expired on the server.
The default is 7200 minutes (120 hours or 5 days). min-ttl <expiry_time> The minimum amount of time an object can stay in the web cache before checking to see if it has expired on the server.
The default is 5 minutes.
512000
7200
5
Fortinet Technologies Inc.
Page 848 FortiOS™ - CLI Reference for FortiOS 5.0
wanopt
Variable
neg-resp-time
<response_time> reval-pnc
{enable | disable}
webcache
Description
Set how long in minutes to cache negative responses. The default is 0, meaning negative responses are not cached.
The content server might send a client error code (4xx HTTP response) or a server error code (5xx HTTP response) as a response to some requests. If the web cache is configured to cache these negative responses, it returns that response in subsequent requests for that page or image for the specified number of minutes.
Default
0
The pragma-no-cache (PNC) header in a client's request can affect the efficiency of the FortiGate unit from a bandwidth gain perspective. If you do not want to completely ignore
PNC in client requests (which you can do by using the ignore
PNC option configuration), you can lower the impact of the
PNC by enabling reval-pnc. When the reval-pnc is enabled, a client's non-conditional PNC-GET request results in a conditional GET request sent to the OCS if the object is already in the cache. This gives the OCS a chance to return the 304 Not Modified response, consuming less server-side bandwidth, because it has not been forced to return full content even though the contents have not actually changed.
By default, the revalidate PNC configuration is disabled and is not affected by changes in the top-level profile. When the
Substitute Get for PNC configuration is enabled, the revalidate PNC configuration has no effect.
disable
Most download managers make byte-range requests with a
PNC header. To serve such requests from the cache, the reval-pnc option should be enabled along with byte-range support.
Fortinet Technologies Inc.
Page 849 FortiOS™ - CLI Reference for FortiOS 5.0
