| In flow mode, the FortiGate will inspect inline-traffic as it passes through the device and will not terminate the client–server TCP connection. Flow mode packets are forwarded end-to-end while the IPS and flow engine perform the inspection. Unlike proxy mode, flow mode has lower latency and reduced buffering. Key points: - Single, pass-through TCP connection between client and server.
- Inspection is performed by IPS and the flow engine (no WAD data-plane proxy is present).
- Full content buffering is not available; only last-packet.
For a flow-mode policy, the FortiGate can create a session representing the end-to-end connection: - Client to FortiGate to Server: this is a single session; the client and server will see each other's IP address.
- No separate 'to-client' and 'to-server' TCP sessions should appear.
Sample output of a flow mode session: diagnose sys session filter src x.x.x.x diagnose sys session list
session info: proto=6 proto_state=01 duration=120 expire=3480 timeout=3600
flags=00000000 sockflag=00000000 sockport=0 av_idx=0 use=5
origin-shaper=
reply-shaper=
per_ip_shaper=
class_id=0 ha_id=0 policy_dir=0 tunnel=/ vlan_cos=0/255
state=log
statistic(bytes/packets/allow_err): org=18432/140/0 reply=32768/220/0
origin->sink: org pre->post, reply pre->post dev=port2->port1/port1->port2 gwy=10.1.1.1/203.0.113.1
hook=pre dir=org act=snat 10.20.30.40:56607->203.0.113.10:80 proto=6
hook=post dir=org act=fw 10.20.30.40:56607->203.0.113.10:80 proto=6
hook=pre dir=reply act=snat 203.0.113.10:80->10.20.30.40:56607 proto=6
hook=post dir=reply act=fw 203.0.113.10:80->10.20.30.40:56607 proto=6
policyid=1 policytype=policy
npu_info=0x0/0x0, flag=0x00/0x00, offload=0/0, ofldpkts=0
no_ofld_reason: disabled by policy
A typical flow mode session will show one entry with org and reply directions followed by hooks; there are no WAD sessions present.
When UTM profiles are configured in flow mode, the cipher list can be viewed by executing the following command from the CLI:
erbium-kvm92 # diagnose ips ssl ciphers Supported cipher suites (159 in total):
---------------------------------------------------------------------
# ID Name
---------------------------------------------------------------------
1 0x1 RSA_WITH_NULL_MD5
2 0x2 RSA_WITH_NULL_SHA
3 0x3 RSA_EXPORT_WITH_RC4_40_MD5
4 0x4 RSA_WITH_RC4_128_MD5
5 0x5 RSA_WITH_RC4_128_SHA
6 0x7 RSA_WITH_IDEA_CBC_SHA
7 0x8 RSA_EXPORT_WITH_DES40_CBC_SHA
8 0x9 RSA_WITH_DES_CBC_SHA
9 0xa RSA_WITH_3DES_EDE_CBC_SHA
10 0xc DH_DSS_WITH_DES_CBC_SHA
. . </truncated/> 159 0xccaa DHE_RSA_WITH_CHACHA20_POLY1305_SHA256
--------------------------------------------------------------------- To verify the inspection mode configured for a policy, run the following commands: show full firewall policy 2 | grep inspection-mode
set inspection-mode flow Note: Flow-based inspection is recommended for policies that prioritize traffic throughput, like allowing connections to a file server, streaming server, or VoIP server.
Related article:
Technical Tip: Change in inspection mode - Flow vs Proxy policy option after upgrade to 6.2 | 
