Skip to main content
rezafathi
rezafathi
Explorer III
December 22, 2023
Solved

Flow based or proxy based

  • December 22, 2023
  • 3 replies
  • 8060 views

Hi

 

I am really confused about flow based and proxy based on firewall policy. When should i use either of these? Fkr example i have 7 servet facing on internet and i configured antivirus,ips and i want to config WAF too but it requires to use proxy based but all other security profiles configured in flow based mode. What should i do?

Best answer by esalija

Hi @rezafathi,

Only the first policy will be matched. You can configure a policy with the security profiles av, web, DNS, IPS and WAF and Proxy-based inspection.

 

Best regards,

Erlin

If you have found a solution, please like and accept it to make it easily accessible to others.

3 replies

AEK
SuperUser
AEK
SuperUser
December 22, 2023

Hello

You can have some rules using flow based and some others using proxy based. You can specify at policy level.

As far as I remember, in some old FOS versions (6.?) you select the mode globally in System > Settings (but I'm not sure).

AEK
hhasny
Staff
hhasny
Staff
December 23, 2023

Hello,

FOS version 6.4 and newer version you can have the inspection mode per policy.

http://docs.fortinet.com/document/fortigate/6.4.0/administration-guide/366651

 

The following helps explaining the different explained inspection mode.

http://docs.fortinet.com/document/fortigate/6.2.0/cookbook/721410/about-inspection-modes

 

regards,

    esalija
    Staff
    esalija
    Staff
    December 23, 2023

     

    Hi @rezafathi 


    In Flow-based inspection: 

     The FortiGate will not buffer traffic flowing through the policy. Flow-based inspection needs lower processing resources than proxy-based inspection and does not change packets unless a threat is found and packets are blocked.

    https://docs.fortinet.com/document/fortigate/7.4.0/administration-guide/659145/flow-mode-inspection...


    In Proxy-based inspection:

    The FortiGate will buffer traffic flowing through the policy for inspection which means that the FortiGate will hold the packets for a file, email message, or web page until the entire payload is inspected for violations (virus, spam, or malicious web links). After FortiOS finishes the inspection, the payload is either released to the destination (if the traffic is clean) or dropped and replaced with a replacement message (if the traffic contains violations). 
    Proxy-based inspection needs more resources than Flow-based and is usually slower than flow-based
    https://docs.fortinet.com/document/fortigate/7.4.0/administration-guide/969330/proxy-mode-inspection

     

    Best regards,

    Erlin

     

    rezafathi
    rezafathiAuthor
    Explorer III
    December 23, 2023

    Thanks. I have vips configured for 7 servers. Can i have a policy in flow based mode for av,web,dns,application,ips and a second policy in proxy mode for waf?

    esalija
    Staff
    esalija
    Staff
    December 23, 2023

    Hi @rezafathi 

    Yes, you can configure different firewall policies, but the FortiGate will match the first policy for the traffic that is running and will not check the other firewall policies that are below that policy.

     

    https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-policy-order-in-works-on-FortiGate/ta-p/207381

     

    Best regards,

    Erlin

    If you have found a solution, please like and accept it to make it easily accessible to others.

    rezafathi
    rezafathiAuthor
    Explorer III
    December 23, 2023

    I mean can i have above 2 policies for protecting my servers? Or only first policy will be selected. I want to secure my servers with av,web,dns,ips and waf. But waf works in proxy mode. What should i do?

    esalija
    Staff
    esalijaAnswer
    Staff
    December 23, 2023

    Hi @rezafathi,

    Only the first policy will be matched. You can configure a policy with the security profiles av, web, DNS, IPS and WAF and Proxy-based inspection.

     

    Best regards,

    Erlin

    If you have found a solution, please like and accept it to make it easily accessible to others.

    Terms & ConditionsCookie settingsAccessibility statement