Created on ‎02-27-2023 09:05 AM Edited on ‎08-23-2024 01:36 AM By Jean-Philippe_P
Description |
This article describes how to use the new proxy features implemented in version 7.2.4, as well as how to enable them in lower-end FortiGates. |
Scope | FortiGate v7.2.4+ (models 40F, 6xE, 6xF, 8xE, 9xE and FortiGate-Rugged 60F with 2 GB versions only). |
Solution |
To use some features (namely the virtual server load balancer and security profile proxy features), it is necessary to configure a firewall policy with proxy inspection mode.
There is a new feature ('gui-proxy-inspection') that is disabled by default on low-end platforms with 2GB or less RAM starting on version 7.2.4 (models 40F, 6xE, 6xF, 8xE). See the release notes for more information.
When the settings 'gui-proxy-inspection' and 'proxy-and-explicit-proxy' are disabled, some features are greyed out or removed from the GUI:
To enable the Proxy Inspection on Firewall Policies, first log in to the FortiGate through the GUI and open a new CLI connection. After, run the following commands:
config system settings set gui-proxy-inspection enable end
Refresh the browser. After, it will be possible to select the inspection mode on the desired firewall policy or enable certain required proxy features.
Note that, when using proxy features, the CPU and memory load may increase. This is because FortiGate buffers all traffic to make appropriate decisions when in proxy-based mode.
Note: As part of improvements to enhance performance and optimize memory usage on FortiGates with 2 GB RAM or less, starting from v7.4.4, FortiOS no longer supports proxy-related features. This change impacts the FortiGate/FortiWiFi 40F, 60E, 60F, 80E, and 90E series of devices and their variants, and FortiGate-Rugged 60F (2 GB versions only).
Irrespective of the setting 'set gui-proxy-inspection', enabled or disabled on the affected devices, you cannot set the mode to proxy based on the firewall policy for the affected low-end devices.
This will not affect the VMs with 2 GB RAM.
Related documents: Proxy-related features not supported on FortiGate 2 GB RAM models Technical Tip: Cannot enable Explicit Proxy feature in FortiGate 2GB Model |