Where to place symantec web gateway proxy?

Hello everyone,

I want to install and configure symantec web gateway virtual edition as a proxy with LDAP integration. I have fortigate installed as a firewall and it is configured to use quotas for different users.

In this case where should I place the web gateway proxy? upstream of the fortigate or downstream? If I place it downstream will the fortigate be able to see that this traffic is coming from this specific user in order to give him his quota? or will the fortigate only see the ip of the proxy which in that case it won't be able to give this user his quota?

Please advise and thank you all in advance.