Technical Tip: Inspection mode option is not visible under Firewall Policy

This article describes that, in FortiGate firewalls operating in NGFW Profile-Based mode, the option to select Flow-based or Proxy-based inspection may not be visible in the GUI under Firewall Policies.

NGFW mode: Profile-Based.
FortiGate running FortiOS v7.2.x and v7.4.x.

Platforms that support Proxy inspection:

• FortiOS v7.4.3 and earlier: Proxy-based inspection is supported on all FortiGate models.
• FortiOS v7.4.4 and later: Proxy-related features are not supported on FortiGate models with 2 GB of RAM or less, such as the FortiGate/FortiWiFi 40F, 60E, 60F, 80E, and 90E series devices, along with their variants, and the FortiGate-Rugged 60F.

It is necessary to change the inspection mode from Flow to Proxy in the policy from the CLI. Once the inspection mode is changed to Proxy, the option to toggle the inspection mode will be available in the GUI.

To change the inspection mode from CLI:

Step 1:

config system global
    set proxy-and-explicit-proxy enable
end

config system settings
    set gui-proxy-inspection enable

end

Step 2:

Inspection mode is visible in the GUI now:

Enable the GUI Inspection option from the CLI:

Inspection mode is visible in the GUI now:

Note:

If the inspection mode is still not visible in the GUI, try the following steps:

1. Log out and log back into the GUI.

2. Clear the browser cache.

3. As a last resort, restart the HTTPS daemon with the following command:

fnsysctl killall httpsd

Now, changing the inspection mode is available in the GUI:

Note:

Starting from FortiGate v7.4.4, Proxy-related features are not supported in FortiGate models with 2GB RAM or less.

Refer to this document for more information: 2 GB RAM FortiGate models no longer support FortiOS proxy-related features.