Technical Tip: Changing the inspection mode of the firewall

Description

This article describes how to change the inspection mode of the firewall. The FortiGate firewall can operate in two different modes:

Flow mode and Proxy mode.

Solution

• Proxy-based: Proxy-based inspection works by buffering traffic and analyzing it before taking action. Packets are stored and reassembled before inspection; the process is slower compared to flow-based, but is more thorough. In this mode, the FortiGate sits between the client and the server, terminates the original connection, inspects the traffic, and then creates a new connection to the destination. This results in two separate sessions (client-to-FortiGate and FortiGate-to-server): Technical Tip: Behavior of firewall policy in proxy mode. The daemon or process involved in proxy-based mode is the wad daemon.

• Flow-based: The flow-based inspection method examines the data packets as they pass through the FortiGate without any buffering. Each packet that arrives is processed and forwarded without waiting for the complete file or web page. The inspection process is quicker in this mode but is less thorough compared to proxy-based.

FortiOS v6.2.x to v7.0.x.

From GUI:

To control the FortiGate's security profile inspection mode per policy, select 'Flow-based' or 'Proxy-based' modes from IPv4 Policy -> Edit (a particular policy).

FortiOS v7.2.4+:

After upgrading firmware v7.2.4+, some devices cannot see inspection mode on the GUI.

 

 

By default, the inspection mode of the new firewall policy is set to Flow-Based. To have this option available in the GUI, enter the following commands in the CLI:

 

config system global
    set proxy-and-explicit-proxy enable
end

config system settings
    set gui-proxy-inspection enable

end

 

Also, from the CLI, use the command below to change the inspection mode to proxy mode:

 

config firewall policy

    edit <firewall policy ID>

           set inspection-mode proxy

end

 

Once these changes are performed, the inspection mode in the GUI will be shown:

 

 

This is an expected behavior, and this feature is placed for a reason.

 

It is possible to review this document for the new feature enhancement of v7.2.4: New features or enhancements.

 

It is also possible to change the inspection mode of Security Profiles, such as Antivirus and Web Filter, to match the inspection mode of the firewall policy. 

 

 

 

Example in the CLI: 

 

config antivirus profile
    edit <name>

        set feature-set flow/proxy 

end 

 

config webfilter profile
    edit <name>

        set feature-set flow/proxy 

end 

 

Note:

When the firewall is running in NGFW policy-based mode, the operational mode is limited to 'flow,' with no possible option to change to 'proxy.'

When the VDOMs are enabled on the firewall, there will not be any option available to change the firewall mode globally; it has to be changed per VDOM.

 

Special note:

Starting from FortiOS v7.4.4, proxy-related features are no longer supported in FortiOS. This change affects models 30G, 40F, 50G, 60E, 60F, 80E, and 90E series devices, including their variants (FortiWifi, FortiGate-3G4G, FortiGate-5G, and FortiGate-POE), as well as the FortiGate-Rugged 60F (2 GB versions only). FortiGate VMs are not impacted by memory size and will continue to support proxy-related features after upgrading to FortiOS v7.4.4. However, a minimum of 4 GB RAM is recommended to ensure optimal performance.

 

Refer to this document for more information: Proxy-related features not supported on FortiGate 2 GB RAM models.

 

Related documents:

Profile based NGFW vs policy-based NGFW

Technical Tip: Using proxy features in lower-end FortiGates 

UTM/NGFW packet flow: flow-based inspection

UTM/NGFW packet flow: proxy-based inspection