Tell me about yourself?
[Link] you explain what a web proxy is and why organizations use it?
Web proxy acts as an intermediary between end users and the internet. Instead of users directly
accessing websites, the traffic first goes to the proxy server. The proxy checks the request based
on company security policies and then forwards the traffic to the internet on behalf of the user.
Organizations mainly use web proxies for web filtering, controlling user internet access, SSL
inspection, malware protection, and monitoring user activity. Since nowadays most traffic is
HTTPS, SSL inspection is important because otherwise the security device cannot see encrypted
traffic.
Earlier proxies were also heavily used for caching to improve bandwidth usage and website
loading performance.
2. “What is the difference between forward proxy and reverse proxy?
“Forward proxy is mainly used on the client side. It sits between internal users and the internet.
When a user accesses a website, the request first goes to the forward proxy, and the proxy
accesses the internet on behalf of the user. Organizations use it for web filtering, SSL inspection,
user authentication, and internet access control. FortiProxy is one example.
Reverse proxy works on the server side. It sits in front of web servers and receives requests from
external users before forwarding them to backend servers. It is commonly used for load
balancing, server protection, SSL offloading, and improving application availability. NGINX is a
common example.
So mainly, forward proxy protects clients, while reverse proxy protects servers.
3. How does SSL inspection work in a web proxy?
SSL inspection is used to inspect encrypted HTTPS traffic. Normally, without SSL inspection,
the proxy cannot see inside encrypted traffic, so security policies like malware scanning or URL
filtering may not work properly.
In SSL inspection, the proxy creates two separate TLS tunnels — one between the client and
proxy, and another between the proxy and the destination server.
When the user accesses an HTTPS website, the proxy first establishes a secure session with the
actual server and receives the server certificate. Then the proxy generates a substitute certificate
for that website using the organization’s internal CA certificate and presents it to the client.
Since the organization’s root CA is already trusted on user machines, usually through GPO, the
browser accepts the certificate without warning.
The proxy decrypts the traffic, applies security inspection and policies, and then re-encrypts the
traffic before forwarding it.
4. What is proxy authentication? And what are the different authentication methods used in web
proxies?
Proxy authentication is the process of verifying user identity before allowing internet access
through the proxy. Organizations use it for user-based access control, logging, monitoring, and
applying security policies based on user or group.
Common authentication methods used in web proxies are Basic authentication, NTLM,
Kerberos, LDAP, and sometimes RADIUS or SAML-based authentication.
In enterprise environments, Kerberos authentication is commonly used because it provides single
sign-on experience. When a domain user logs into a domain-joined system, the client gets a
Kerberos ticket from Active Directory. When the user accesses the internet through the proxy,
the browser presents the ticket to the proxy, and the proxy validates it with Active Directory
before allowing access.
5. What is the difference between Kerberos and NTLM authentication in proxy environments?
Kerberos and NTLM are both authentication protocols used mainly in Windows environments,
but Kerberos is more secure and modern compared to NTLM.
Kerberos is ticket-based authentication. When a user logs into a domain-joined system, Active
Directory provides a Kerberos ticket. Later, when the user accesses services like a web proxy,
the client presents the ticket instead of repeatedly sending credentials. This provides single sign-
on experience and better security.
NTLM is an older Microsoft authentication protocol that uses challenge-response mechanism
based on username and password hashes. It does not provide the same efficient SSO experience
as Kerberos and is considered less secure and less scalable.
In proxy environments, Kerberos is generally preferred because it supports seamless
authentication, better security, and lower credential exposure.
6. A user says HTTPS websites are not opening after SSL inspection was enabled. What would you check?
If HTTPS websites stop working after enabling SSL inspection, first I would check the exact
browser error message to understand whether it is a certificate issue, handshake failure, or
policy-related issue.
My first technical check would be whether the organization’s root CA certificate is properly
installed and trusted on the user machine. If the browser does not trust the proxy certificate,
HTTPS websites will fail with certificate warnings.
Then I would check proxy logs and SSL inspection logs to see whether the traffic is getting
blocked or failing during TLS handshake.
I would also verify whether the website or application uses certificate pinning, because some
applications do not work properly with SSL inspection enabled.
Additionally, I would check the SSL inspection policy, supported TLS versions, cipher
compatibility, and whether the traffic is matching the correct proxy policy.
For troubleshooting, I may temporarily bypass SSL inspection for that website to confirm
whether SSL inspection is the actual cause.
7. What is certificate pinning, and why does SSL inspection fail for certificate-pinned applications?
“Certificate pinning is a security mechanism where an application is programmed to trust only a
specific server certificate, public key, or certificate fingerprint.
Normally during SSL inspection, the proxy intercepts HTTPS traffic and generates a substitute
certificate signed by the organization’s internal CA certificate.
Even though the browser or operating system may trust the organization’s CA, certificate-pinned
applications perform additional validation and expect the original server certificate or public key.
Since the certificate presented by the proxy does not match the pinned certificate information,
the application rejects the connection, which causes SSL inspection to fail for those applications.
8. What is the difference between transparent proxy and explicit proxy?
In explicit proxy deployment, the client browser or operating system is manually configured with
the proxy IP address and port number, or through a PAC file. So the client is aware that it is
communicating with a proxy server.
In transparent proxy deployment, no proxy configuration is required on the client side. The
traffic is automatically intercepted and redirected to the proxy without the user or browser being
aware of it.
Explicit proxy is generally preferred when organizations need better authentication control, user-
based policies, and detailed proxy features. Transparent proxy is easier to deploy because no
client-side configuration is needed, but it may have some limitations with authentication and
HTTPS traffic handling.
9. How does a proxy know which user is generating traffic in transparent proxy mode?
“In transparent proxy mode, the browser is not directly aware of the proxy, so user identification
becomes slightly more challenging compared to explicit proxy.
Organizations usually identify users through methods like captive portal authentication, IP-to-
user mapping, or integration with Active Directory services such as FSSO.
In enterprise environments, the most common method is IP-to-user mapping. When a user logs
into a domain-joined system, the firewall or proxy learns the username associated with the client
IP address through Active Directory integration. Later, when traffic is transparently intercepted,
the proxy applies policies based on that user-to-IP mapping.
In guest Wi-Fi or BYOD environments, captive portal authentication is commonly used where
users manually authenticate through a web portal before getting internet access.
10. A company wants to block social media websites for employees, but management team should still
have access. How would you implement this in a proxy solution?
I would implement this using user or group-based proxy policies.
First, I would integrate the proxy with Active Directory so users can be identified through
authentication or identity mapping.
Then I would create a separate group for management users and apply an allow policy for social
media categories to that group.
After that, I would create another policy for regular employees where social networking
categories are blocked through web filtering.
Since proxy policies are processed in top-down order, the management allow policy should be
placed above the general employee deny policy to ensure management users are matched first.
10. What happens when a user inside the LAN opens [Link] through a FortiGate firewall?
When a user opens [Link], the PC first sends a DNS request to resolve the domain name
into an IP address.
After receiving the IP address, the PC checks whether the destination is in the local network.
Since Google is on the Internet, the packet is sent to the configured default gateway, which is
usually the FortiGate firewall.
When the packet reaches the FortiGate, the firewall checks whether there is an existing session.
If no session exists, it creates a new session entry and evaluates the firewall policy.
The firewall then verifies whether a policy allows traffic from the LAN interface to the WAN
interface for HTTPS traffic.
If the policy is allowed, the firewall performs source NAT, translating the user's private IP
address to the public IP configured on the WAN interface.
If security profiles such as Web Filtering, Application Control, IPS, or Antivirus are enabled, the
traffic is inspected according to the configured security policy.
The firewall then consults the routing table and forwards the packet toward the Internet.
When Google responds, the return traffic comes back to the FortiGate public IP. The firewall
matches it against the existing session entry and allows the traffic back to the user without
requiring another policy evaluation.
Finally, the user receives the webpage successfully.
11. A user says:Internet is not working?.
If a user reports that internet is not working, I would first verify the issue from the user's side.
I would check whether the user has received a valid IP address, subnet mask, DNS server and
default gateway. Then I would verify connectivity by pinging the default gateway.
If local connectivity is working, I would test DNS resolution to confirm whether domain names
are resolving correctly.
After that, I would move to the FortiGate firewall and verify whether the user traffic is reaching
the firewall. I would check the firewall policy from LAN to WAN and ensure that the traffic is
matching the correct policy.
Next, I would verify whether source NAT is configured correctly and whether the firewall has a
valid route toward the Internet.
I would then review forward traffic logs to see whether the traffic is being allowed or denied. If
security profiles such as Web Filter, IPS, Antivirus or Application Control are enabled, I would
check whether any of them are blocking the traffic.
If the issue is still unclear, I would use troubleshooting tools such as ping, traceroute and debug
flow on the FortiGate to identify exactly where the packet is being dropped.
Based on the findings, I would implement the required fix and verify that the user can access the
Internet successfully.
12. Explain NAT and PAT.
NAT stands for Network Address Translation. It is used to translate a private IP address into a
public IP address so that internal devices can communicate over the Internet. Since private IP
addresses are not routable on the public Internet, NAT allows organizations to use private
addressing internally while accessing external resources.
PAT stands for Port Address Translation, which is a type of NAT. In PAT, multiple internal
devices share a single public IP address. The firewall differentiates the sessions by translating the
source port numbers into unique port numbers.
For example, if multiple users access Google simultaneously, FortiGate translates their private IP
addresses to the same public IP while assigning different source ports to each session. When the
response comes back, the firewall uses the translated port information in its session table to send
the traffic back to the correct user.
This allows thousands of users to share one public IP address efficiently while conserving public
IP resources.
[Link] is the difference between Stateful Firewall and Stateless Firewall?
A stateful firewall maintains a session table and keeps track of active connections. When a user
initiates a connection, the firewall evaluates the security policy and creates a session entry
containing information such as source IP, destination IP, ports and protocol.
Once the session is established, return traffic is automatically allowed because the firewall
recognizes it as part of an existing session.
A stateless firewall does not maintain session information. Every packet is inspected
independently against the configured rules, regardless of whether it belongs to an existing
connection.
FortiGate is considered a stateful firewall because it tracks connection states and uses a session
table to process traffic efficiently. This allows return traffic to be permitted automatically
without requiring separate policies for each direction.
15. Explain the difference between:
1. Flow-based inspection
2. Proxy-based inspection
3. Flow-based and proxy-based inspection are two methods used by FortiGate to inspect
traffic.
4. In flow-based inspection, the firewall inspects traffic as it passes through the device. The
traffic does not need to be fully buffered before inspection, which results in lower latency
and better performance.
5. In proxy-based inspection, the firewall acts as an intermediary between the client and the
server. It terminates the session, reconstructs the content, performs a deeper inspection,
and then establishes a new connection toward the destination.
6. Because proxy-based inspection buffers and analyzes more of the traffic, it generally
provides more thorough inspection capabilities but introduces additional latency and
consumes more resources.
7. In environments where performance is the priority, flow-based inspection is commonly
used. In environments requiring deeper content inspection and stricter security controls,
proxy-based inspection is often preferred.