flow based vs proxy based

Hi,

As I undesrstand you want to know the difference between Flow based and Proxy based Policy.
Please refer to the below documents  regarding this:
Flow Based: 

https://docs.fortinet.com/document/fortigate/7.4.0/administration-guide/659145/flow-mode-inspection-default-mode

Proxy Based :
https://docs.fortinet.com/document/fortigate/7.4.0/administration-guide/969330/proxy-mode-inspection

Regards,

Abhimanyu

Hi unknown1020,

In Flow based inspection:  Traffic flowing through the policy will not be buffered by the FortiGate. Flow-based inspection needs lower processing resources than proxy-based inspection and does not change packets, unless a threat is found and packets are blocked.

In Proxy based inspection: Traffic flowing through the policy will be buffered by the FortiGate for inspection which means that the packets for a file, email message, or web page will be held by the FortiGate until the entire payload is inspected for violations (virus, spam, or malicious web links). After FortiOS finishes the inspection, the payload is either released to the destination (if the traffic is clean) or dropped and replaced with a replacement message (if the traffic contains violations). 
Proxy based inspection needs more resources than Flow based and usually slower than flow based inspection.

Regards,
Parteek

Hi,

Flow-Based:-

Flow-based UTM/NGFW inspection identifies and blocks security threats in real-time as they are identified using a single-pass architecture that involves Direct Filter Approach (DFA) pattern matching to identify possible attacks or threats.

If a firewall policy is configured for flow-based inspection, depending on the options selected in the firewall policy that accepted the session, flow-based inspection can apply IPS, Application Control, Web Filtering, DLP, Botnet checking, and AntiVirus. Flow-based inspection is all done by the IPS engine and as you would expect, no proxying is involved.

IPS, Botnet checking, and Application Control are only applied using flow-based inspection. Web Filtering, DLP, and Antivirus can also be applied using proxy-based inspection.

Note:-
Flow-based DLP is supported but not recommended. Flow-based DLP is not available from the GUI, but can be configured from the CLI.

Sniffer-policy and interface-policy are supported only in flow-based inspection.

Proxy-policy is supported in mixed flow-based and proxy-based inspection mode; but the inspection mode is assumed to be proxy-mode and is not configurable.

Proxy Based:-

If a firewall policy is configured for proxy-based inspection then a mixture of flow-based and proxy-based inspection occurs. Packets initially encounter the IPS engine, which uses the same steps described in UTM/NGFW packet flow: flow-based inspection to apply single-pass IPS, Botnet checking, and Application Control if configured in the firewall policy accepting the traffic.

Proxy-based inspection extracts and caches content, such as files and web pages, from content sessions and inspects the cached content for threats. Content inspection happens in the following order: VoIP inspection, DLP, Email Filter (Anti-Spam), Web Filtering, AntiVirus, and ICAP.

If no threat is found the proxy relays the content to its destination. If a threat is found the proxy can block the threat and replace it with a replacement message.

Please check below link for the life of a packet on fortigate.

https://docs.fortinet.com/document/fortigate/6.4.0/parallel-path-processing-life-of-a-packet/466137/introduction

Regards

Priyanka

Hi,

I understand that you want to know the difference between flow based and proxy based inspection mode.

You may refer to this link for more info:

https://docs.fortinet.com/document/fortigate/7.4.0/administration-guide/721410/inspection-modes#:~:text=in%20firewall%20policies.-,You%20can%20select%20the%20inspection%20mode%20when%20configuring%20a%20policy,the%20content%20for%20security%20threats.

BR,

Manosh

Hi All,

As i understand flowbased inspect the UTM features in-line with policy and proxy based buffer packet then scan everything and then send this to client or server.

I have one small doubt for flow-based inspection.

As per fortigate guide.

When a firewall policy’s inspection mode is set to flow, traffic flowing through the policy will not be buffered by the FortiGate. Unlike proxy mode, the content payload passing through the policy will be inspected on a packet by packet basis with the very last packet held by the FortiGate until the scan returns a verdict. If a violation is detected in the traffic, a reset packet is issued to the receiver, which terminates the connection, and prevents the payload from being sent successfully.

Correct my understanding.

In flow-based all packets are send to client or server and only last packet is droped if any issues found 

or packet comes to firewall -> scanned -> send to destination and then same thing happens to other packet and in case any packet found with issues like virus or blocked action from policy then connection reset send to destiantion.