# Enable redirection to the original destination

Add the necessary Access rules to configure the redirection of unauthenticated HTTP or HTTPS connections from the status page to the destination that the user originally wanted to access.

##

Note: To redirect HTTPS traffic, you must enable TLS decryption for the traffic.

You must define the following IPv4 or IPv6 Access rules:

- An Access rule that allows all clients to access destinations that do not require authentication.
- An Access rule that allows authenticated users to establish HTTP or HTTPS connections.
- An Access rule that redirects unauthenticated HTTP or HTTPS traffic to an Inspection rule.
- An Access rule that refuses all HTTP or HTTPS traffic.

Using the HTTP_Request-with-redirect-capability Situation, you must also define the following Inspection Exceptions in the Inspection Policy:

- An Exception that permits all matching connections to access destinations that do not require authentication.
- An Exception that permits authenticated users to establish HTTP connections.
- An Exception that redirects unauthenticated HTTP traffic to the logon page using the original destination URL as a parameter in the redirection.

For more details about the product and how to configure features, click Help or press F1.

## Steps

1. Select Configuration.
2. Browse to Policies > <Policy type>.
3. Open the Firewall Policy for editing, then add the following Access rules:

   Table 1. Example Access rules for redirecting unauthenticated HTTP connections to the original HTTP destination
   Source | Destination | Service | Action | Authentication
   --- | --- | --- | --- | ---
   ANY | IP addresses of services that do not require authentication. | HTTP HTTPS | Allow |
   ANY | ANY | HTTP HTTPS | Allow | Users/User Groups who are allowed to access services, and appropriate Authentication Methods.
   ANY | IP addresses of network services that require authentication. | HTTP HTTPS | Allow Deep Inspection: on |
   ANY | ANY | HTTP HTTPS | Refuse |

   Note: Deep Inspection must be enabled in the Access rules for redirecting unauthenticated HTTP or HTTPS connections to the original destination. The redirection must be configured in the Inspection Policy using the HTTP_Request-with-redirect-capability Situation.
4. Click Save.
5. Open the Inspection Policy for editing.
6. Add the following Inspection Exceptions, then specify a User Response that redirects traffic terminated by the Inspection rules to the URL of the logon page and onwards to the original destination.

   Table 2. Example Inspection Exceptions for redirecting unauthenticated HTTP connections to the original HTTP destination
   Situation | Severity | Source | Destination | Protocol | Action
   --- | --- | --- | --- | --- | ---
   HTTP_Request-with-redirect-capability | ANY | ANY | IP addresses of services that do not require authentication | ANY | Permit
   HTTP_Request-with-redirect-capability | ANY | Users/User Groups who are allowed to access services, and appropriate Authentication Methods. | ANY | ANY | Permit
   HTTP_Request-with-redirect-capability | ANY | ANY | ANY | HTTP | Terminate Response: redirect to the logon page, including the original URL as a parameter in the redirection

7. Click Save and Install.