Technical Tip: Unable to configure firewall policy in proxy inspection mode with fresh installation of FOS 7.4.1 on entry-level FortiGates

kcheng · ‎12-01-2023

Description

This article describes the behavior where for the entry model FortiGates (lower than 100 series), it is not possible to configure a firewall policy in proxy mode with a fresh installation of FortiOS 7.4.0 or above.

Scope

FortiOS 7.4.0 and above and all entry-level FortiGate (lower than 100 series).

Solution

In a new installation of FortiOS 7.4.0 and above, one can observe that it is impossible to change the firewall policy from the default flow-based mode to proxy-based inspection:

FortiGate-61F # config firewall policy

FortiGate-61F (policy) # edit 1
change table entry '1'

FortiGate-61F (1) # set in
internet-service Enable/disable use of Internet Services for this policy. If enabled, destination address and service are not used.
internet-service-src Enable/disable use of Internet Services in source for this policy. If enabled, source address is not used.
internet-service6 Enable/disable use of IPv6 Internet Services for this policy. If enabled, destination address and service are not used.
internet-service6-src Enable/disable use of IPv6 Internet Services in source for this policy. If enabled, source address is not used.

FortiGate-61F (1) # end

** No option for inspection-mode

** This issue does not exist with fresh installation of FortiOS 7.2.6

For the FortiOS 7.4.0 and above, it is possible to see the feature ID 829475 in this document: New features or enhancements.

This includes the capability of configuring firewall policy in proxy-inspection mode. To enable the feature, enable the respective with the following command:

config system global

set proxy-and-explicit-proxy enable

end