Skip to main content
usmansa1
usmansa1
Visitor III
October 20, 2024
Question

Proxy/flow based inspection mechanism ?

  • October 20, 2024
  • 2 replies
  • 2602 views

Hi everyone, 

 

I was reading proxy based and flow based inspection. When i read the proxy based inspection mechanism it explains that the Fortigate deeply inspect the packet and flow based just check the pattern and packet is not decrypted in both cases unless we choose the SSL decryption profile.

Now if the packet is not decrypted then in that case the only thing that can be checked is the certificate or packet headers or may be some initial TCP packets. In this case, what is the purpose of having two different mechanism proxy based and flow based if only thing you can check is headers and content is all encrypted ? even the antivirus cant check all the attachments because every packet is encrypted ? so how does this work ?

2 replies

AEK
SuperUser
AEK
SuperUser
October 21, 2024

Hello Usmansa

It is true that most internet traffic is encrypted, but inside a company this is not always true, and in such case it can make the difference to use flow based or proxy based without deep inspection.

AEK
    usmansa1
    usmansa1Author
    Visitor III
    October 22, 2024

    so it seems like these mechanisms are intended to be used for internal traffic which means internal organizational traffic which is not encrypted 

      pminarik
      Staff
      pminarik
      Staff
      October 22, 2024

      Indeed there is not much to inspect when looking at encrypted traffic without any attempt to decrypt it. In this scenario, the proxy- vs flow-mode distinction is rather academic and not very practical.

       

      The distinction is meaningful primarily when dealing with non-encrypted traffic, or with traffic traffic that is being decrypted ("SSL deep inspection") and thus the inner contents are visible to the FortiGate and available for inspection.

        usmansa1
        usmansa1Author
        Visitor III
        October 26, 2024

        Hi, 

        thanks for your response, however i have one more question, I checked the Packet life document and other documents for inspection mode. In proxy mode inspection mechanism, the FGT cached all the contents of the payload in its buffer and then once the payload is completed, it then examine and after that it will forward to the user.

        If payload is transferred via TCP from server then each packet in payload needs an acknowledgement and if the payload is cached on the FGT and not sent to the user then this means that the user is not sending the acknowledgement packet to server, so in this case my question is that will the FGT send the acknowledgement packets to server ?

        Terms & ConditionsAccessibility statement