Flow Based Antivirus Profile in FortiGate Proxy mode?

Question

Hello guys,

is now the only way to use Flow Antivirus Profile is switching the FortiGate completly to flow mode?

i wanted to use Proxy AV for Internet Access and Flow AV for Site to Site VPN, but of what i see i first was not able to create any flow based AV Profiles in Gui, i then Created one flow mode profile through CLI but now i cannot assign it to the Site to Site VPN Policy.

You cannot mix it anymore? i mean i dont want to use Proxy for VPN Connections i just want to use flow mode.

is there any workaround for that?

Thank you

AndreaSoliva · Answer

Hi

based on 5.4.1 you can mix up whatever you want! This means: Even you set global the FGT in Proxy Mode you can change afterwards every existing profile under CLI as Flow-Mode. The other way arround is also possible. Be careful if you mix Flow and/or Proxy Mode together in one Firewall Policy Rule this means:

"If you mixup Proxy and/or Flow Mode in one Firewall Policy Rule it will be used for all UTM functions which can be set to Proxy and/or Flow Mode Proxy-Mode even the security profiles is set to Flow Mode"

This beahaviour regarding Flow Proxy and what Profile is using what or can be use for what is decribed in the Fortinet Document "Life of a Packet".

hope this helps

have fun

Andrea

Sign up

Login with SSO

Login to the community

Login with SSO