WAN Optimization

Module Objectives By the end of this module participants will be able to: Describe the factors that can impact the performance of applications deployed in a WAN environment Describe the FortiGate WAN optimization techniques Define peers participating in a WAN optimization session Configure WAN optimization rules Configure web caching

WAN Optimization Some of the factor driving the need for WAN optimization include: Centralization of mission-critical resources at the Data Center Application access though web-based portals Server consolidation Software-as-a-service Internet for WAN

WAN-Deployed Application Performance Accessing applications across the WAN introduces a bottleneck into the system WANs become congested, slow, and error-prone Increasing application response times for remote office users Performance of applications deployed in a WAN environment can be negatively affected by: Bandwidth Latency Congestion Packet Loss Click here to read more about factors that can impact applications deployed in WAN environments

WAN Optimization and Web Cache The FortiGate unit includes WAN optimization and web caching features : Reduce transfer times across the WAN Accelerate web applications or web servers by reducing bandwidth usage, server load, and perceived latency Reduce WAN bottleneck enabling more data to be sent Provide a more efficient usage of available WAN bandwidth Traffic passing between clients to servers is intercepted by the FortiGate unit and WAN optimization techniques can be applied IPSec and WAN optimization can be combined effectively to provide accelerated throughput over secure connections WAN optimization can also be expanded to remote PCs running FortiClient

FortiGate WAN Optimization Techniques Click here to read more about FortiGate WAN optimization techniques Protocol Optimization HTTP/HTTPS CIFS FTP MAPI TCP

FortiGate WAN Optimization Techniques Click here to read more about FortiGate WAN optimization techniques Protocol Optimization HTTP/HTTPS CIFS FTP MAPI TCP Protocol optimization improves performance by reducing the amount of traffic required by communication protocols Uses various techniques to reduce the amount of background transactions that occur over the WAN

FortiGate WAN Optimization Techniques Click here to read more about FortiGate WAN optimization techniques Byte Caching Byte cache dictionary token Byte cache dictionary token

FortiGate WAN Optimization Techniques Click here to read more about FortiGate WAN optimization techniques Byte Caching Byte cache dictionary token Byte cache dictionary token Each chunk of data is labeled with a token which is stored in the byte cache dictionary on both ends of the connection When the FortiGate unit spots a data sequence already in the dictionary, it sends the corresponding token instead The remote FortiGate unit looks up the token in the dictionary and restores the data chunk to its original form

FortiGate WAN Optimization Techniques Click here to read more about FortiGate WAN optimization techniques Web Caching Web cache Web server page.html welcome.html readthis.html page.html

FortiGate WAN Optimization Techniques Click here to read more about FortiGate WAN optimization techniques Web Caching Web cache Web server Web caching stores web-based objects for later retrieval Objects are cached on the hard disk of the FortiGate unit The FortiGate unit caching the objects does not need to contact the web server, except to check for changes Improves performance in that fewer requests and responses pass over the WAN

Transparent Proxy Click here to read more about FortiGate WAN optimization techniques Transparent proxy disabled Source IP address of clientSource IP address of FortiGate unit interface Transparent proxy enabled Source IP address of client

Transparent Proxy Click here to read more about FortiGate WAN optimization techniques Servers receiving packets after WAN optimization see different source addresses depending on whether the transparent proxy is enabled If enabled, WAN optimization keeps the original source address of the packets If not enabled, source address of the packet is changed to the address of the FortiGate unit interfaces Routing is easier because client addresses are not involved

Supported FortiGate Devices FortiGate WAN optimization and web caching is currently supported on the following devices: FortiGate 51B FortiWiFi 81C FortiGate 111C FortiGate 310B with ASM-S08 FortiGate 311B FortiGate 620B with ASM-S08 FortiGate 3016B with ASM-S08 FortiGate 3600A with ASM-S08 FortiGate 3810A with ASM-S08 FortiGate 5001A-SW with ASM-S08

WAN Optimization Rules Firewall policy WAN optimization rules UTM Identity-based policies Click here to read more about FortiGate WAN optimization rules

WAN Optimization Rules Firewall policy WAN optimization rules UTM Identity-based policies WAN optimization uses rules to determine which traffic is to be optimized Traffic must be accepted by the firewall policy before any WAN optimization operations are performed If the firewall policy includes threat management profiles, the packet is not processed by WAN optimization WAN optimization is compatible with identity- based policies Click here to read more about FortiGate WAN optimization rules

WAN Optimization Rule Ordering

WAN optimization and web caching rules are applied from top to bottom Ordering is important Rules are matched on source address, destination address and destination port First matching rule is applied Make rules as specific as possible Avoids matching sessions which do not require optimization and may fail if optimization is applied

WAN Optimization Rule Parameters

WAN Optimization Modes Active-Passive Mode Peer-to-Peer Mode Client FortiGate unit Server FortiGate unit Active rulesPassive rules Peer B: Peer A:

WAN Optimization Modes Active-Passive Mode Peer-to-Peer Mode Client FortiGate unit Server FortiGate unit Active rulesPassive rules Peer B: Peer A: In Active-Passive Mode, the ends of the WAN optimization tunnel operate in a kind of client/server configuration Session originating on the client FortiGate unit use active rules and those terminating on the server FortiGate unit use passive rules Active rules determine WAN optimization techniques Passive rules operate as determined by the active rule In Peer-to-Peer Mode both ends of the tunnel have peer lists Includes the name and IP address of other FortiGate units with which they can form WAN optimization tunnels

Active-Passive Rules Active (Client) configurationPassive (Server) configuration

Peer-to-Peer Rules Initiator Configuration Responder Configuration

Peer-to-Peer Rules Configuring FortiGate1Configuring FortiGate2config wanopt settings set host-id “FortiGate1”set host-id “FortiGate2”endconfig wanopt peer edit “FortiGate2”edit “FortiGate1” set ip set ip nextend

Authentication Groups Accept Any Peer Authentication Method

Authentication Groups Accept Defined Peers Authentication Method

Authentication Groups Specify Peer Authentication Method

Authentication Groups Specify Peer Authentication Method Authentication groups can be added to support authentication and secure tunneling between WAN optimized peers Select the authentication method used between the two peers: Digital certificate Pre-shared key Select which peers are to be accepted: Accept Any Peer Accepted Defined Peers Specify Peer

WAN Optimization with SSL Traffic needs to be unencrypted to apply optimization techniques SSL handshake proceeds between the originating client and the server-side FortiGate unit The server-side FortiGate unit consults the configured SSL server list The server-side FortiGate unit passes the SSL session key and negotiated cipher to the client-side FortiGate unit through a secure tunnel or IPSec VPN The server-side FortiGate unit may use an HTTPS connection with server ‘full-mode’ or HTTP connection ‘half-mode’ with port forwarding (SSL offloading)

FortiGate-to-FortiGate Sample Configuration PC PC FGT FGT IPSec VPN Define peers

FortiGate-to-FortiGate Sample Configuration PC PC FGT FGT IPSec VPN Active Configuration

FortiGate-to-FortiGate Sample Configuration PC PC FGT FGT IPSec VPN Passive Configuration

FortiGate-to-FortiGate Sample Configuration PC PC FGT FGT IPSec VPN 1 st copy No optimization

FortiGate-to-FortiGate Sample Configuration PC PC FGT FGT IPSec VPN 2nd copy Optimized Optimize CIFS from * to * using protocol optimization and byte caching

FortiClient-to-FortiGate Sample Configuration Client DHCP assigned IP address Server FGT Public IP address IPSec VPN No optimization IPSec VPN between client and gateway without WAN optimization

FortiClient-to-FortiGate Sample Configuration Client DHCP assigned IP address Server FGT Public IP address IPSec VPN FortiClient Enable WAN Optimization config wanopt settings set host-id "lab" end config wanopt auth-group edit "auth-fc" set cert "Fortinet_Factory" next end config wanopt rule edit 1 set dst-ip set port 80 set auto-detect passive set webcache enable next end

FortiClient-to-FortiGate Sample Configuration Client DHCP assigned IP address Server FGT Public IP address IPSec VPN FortiClient Enable WAN Optimization Optimized HTTP optimization and byte cache

Storage Data storage must be defined for web caching and byte caching Internal hard drive AMC slot Click here to read more about web caching storage requirements

Web Cache Settings

Web Cache Exempt List

Define the pattern for URLs that will be exempt from web caching

Web Cache Communication Protocol Support Web Cache Communication Protocol (WCCP) is a content-routing protocol that provides a mechanism to redirect traffic flows in real-time WCCP v2 support can be configured on the FortiGate unit to optimize web traffic Transparently redirects selected types of traffic to a group of cache servers If copy cached, cache server returns page If copy not cached, cache server retrieves page and forwards to FortiGate unit Click here to read more about WCCP support on the FortiGate unit

Web Cache Communication Protocol Support Intranet Internet Web Cache Server

WCCP Configuration Configure the Service Group config system wccp edit "0" set router-id set server-list set authentication enable set forward-method GRE set return-method GRE set password fortinet end

WCCP Configuration Configure WCCP on the FortiGate interface edit port2 set wccp enable end

WCCP Configuration Enable WCCP on the firewall policy config firewall policy edit 1 set srcintf "port1" set dstintf "port2" set srcaddr "all" set dstaddr "all" set action accept set schedule "always" set service "HTTP" set wccp enable set nat enable end

WCCP Messages Internet Web Cache Server Here I amI see you Intranet

WCCP Debugging Real Time Debug diag debug en diag debug application wccp Application Debug diag test application wccpd

Monitoring WAN Optimization

Labs Lab - WAN Optimization Configuring WAN optimization rules and policies Testing WAN optimization Click here for step-by-step instructions on completing this lab Lab - Web Cache Defining a new rule for web caching Click here for step-by-step instructions on completing this lab

Student Resources Click hereClick here to view the list of resources used in this module