Inspection modes and security profiles

Forum|Forum|4 years ago
January 19, 2022
6 replies
6099 views

Hi community,

I know the inspection mode is how FortiGate scans the traffic in a firewall policy. Flow-based is like looking at the TCP flow or taking snapshots of the traffic, and in proxy-based mode FortiGate intercepts the traffic like a man-in-the-middle scenario.

But how is the inspection mode related to security profiles. Can you configure a firewall policy in flow-based inspection mode, and apply a proxy-based AV security profile? Or can you configure a firewall policy in proxy-mode inspection mode, and apply a flow-based web filtering profile?

Regards,

Julián

FortiGate

fjulianomAuthor

Explorer II

Hi guys,

Any idea?

Regards,

Julián

A

Anonymous_User

Contributor III

Hello,

As per your query, if you would add a flow-based inspection profile to the proxy-based policy you will see the warning sign on the policy saying that some of the features would not work or the Security profile needs to be configured to proxy-based. or based upon the inspection mode.
So to answer your question, yes you configure a firewall policy in proxy-mode inspection mode and apply a flow-based web filtering profile. However, the inspection might not work as the way it should

fjulianomAuthor

Explorer II

Hi Mohit,

Ok, I understand. But my actual question is, why do you need to set a flow-based or proxy-based inspection mode if you can set a flow-based or proxy-based web filtering (for example) profile? It seems you are setting the same twice. It seems they are the same. You are actually setting the inspection mode in the security profile. For me setting the inspection mode is redundant since you choose the mode when you configure the security profile. Or am I missing anything?

Regards,

Julian

Debbie_FTNT

Staff & Editor

Hey fjulianom,

the proxy/flow-mode inspection is per policy, I believe, because different processes will handle the inspection (and security profiles) based on that setting.

This policy setting decides which overall process takes responsibility for the packet/inspection, and loads according AV/IPS/webfilter/etc modules.

There is a fixed order how the traffic is inspected; and the first decision needs to be proxy or flow-based inspection, before the packet(s) is/are checked against the different profiles.

The profiles have different inspection options because some underlying settings in the profile may depend on inspection mode - like inspecting MAPI in AntiVirus settings.

-> That is also why you get warnings when having a mismatch between policy inspection and UTM profile inspection mode.

Sign up

Login with SSO

Login to the community

Login with SSO