Technical Tip: Behavior of firewall policy in proxy mode

When a firewall policy operates in proxy mode, FortiGate functions as a transparent proxy between the client and the server. Instead of forwarding packets directly, FortiGate:

• Acts as the termination point for the client's connection (there is no direct session from client to server).
• Buffers and inspects the traffic.
• Establishes a separate connection to the destination server on behalf of the client.

Below is the sample output of the WAD session list:

diagnose wad filter src x.x.x.x

diagnose wad session list

Session: transparent proxy 10.39.11.147:56607(10.5.205.185:56607)->63.137.229.1:80
id=78307 worker=0 vd=0:0 fw-policy=1
duration=3 expire=3587 session-ttl=3590
state=3 app=http sub_type=0 wan_opt_mode=0 dd_method=0
SSL disabled
to-client
TCP Port:
state=2 r_blocks=1 w_blocks=0 read_blocked=0
bytes_in=369 bytes_out=222 shutdown=0x0
to-server
TCP Port:
state=2 r_blocks=0 w_blocks=0 read_blocked=0
bytes_in=222 bytes_out=369 shutdown=0x0

This means that two distinct connections are created.
Client to FortiGate.
FortiGate to the server.

The following snapshots were taken for the connection between the client and the FortiGate and the FortiGate to the server. 

Client to FortiGate:

FortiGate to the server:

The highlighted parameters facilitate troubleshooting. 

The above output shows two connections, which include the client to the firewall and the firewall to the server.

This information is helpful when the TCP handshake is successful in Wireshark, but the website does not work (there may be no TCP handshake completing on the FortiGate -> Server session).

More details on how the firewall handles packets when  proxy-based inspection is enabled can be seen here:
UTM/NGFW packet flow: proxy-based inspection 

Notes:

• Proxy inspection should be used for policies where malicious content or data leaks are crucial.
• Proxy-based inspection generally has a lower throughput than flow-based inspection, as the FortiGate needs to handle two sessions for every client session and cannot offload this traffic to the NPU.