Archived Content

[Ismael_Awamleh]

Hello everyone,

While I was reading about IPS and how it is being used when in flow based for various security features, such as Antivirus, Web Filtering any many more. What I was intrigued about is the behavior when it is in proxy mode and I found a thread about it, but when I click on it all I see is "This Content was Archived". I can read the first two sentences of the thread from the google search, but it ends right when the person is explaining what happens in proxy based. 

Here's the link: https://community.fortinet.com/t5/contentarchivals/contentarchivedpage/message-uid/72266

[Anthony_E]

Hello Ismael,

Could you please give me the title of the article you found on Google please?

If the article has been archived, it is surely because another document related to this topic is existing. I will try to find it for you.

Regards,

[Ismael_Awamleh]

Hello Anthony,

The title is 

RE: Antivirus change from Proxy-based to Flow-Based

Here's a snapshot as well

[Ismael_Awamleh]

I ended up finding the thread by copy pasting the title instead of the two lines under it which sent me to the Archived link for some reason. Just to make sure here the IPS will not be used when in proxy mode contrary to flow based, is that right?

[pminarik]

IPS will be used even with proxy-mode inspetion if:

- "inspect all ports" is enabled in protocol options/SSL inspection (IPS is used to identify the protocol and whether wad/proxyy should further be interested in it)

- or if Appcontrol/IPS profiles are included in the policy. (unless you're using new inline feature in 7.4.2+ (link - 959763) .

[ozkanaltas]

Hello @Ismael_Awamleh ,

You can review these documents about inspection modes. 

https://docs.fortinet.com/document/fortigate/7.4.0/administration-guide/659145/flow-mode-inspection-...

https://docs.fortinet.com/document/fortigate/7.4.0/administration-guide/969330/proxy-mode-inspection

https://docs.fortinet.com/document/fortigate/6.2.0/cookbook/721410/about-inspection-modes

PS

https://community.fortinet.com/t5/Support-Forum/Flow-based-and-proxy-based-inspection-explanation-ne...

[Ismael_Awamleh]

Thank you for providing these links, and I did stumble upon those threads earlier and read them, but they do not specifically compare the behavior of IPS when in flow-based vs proxy-based. Unlike the thread I am looking to read. Unless I missed something, which I would be grateful if you'd highlight it.

[Anthony_E]

Thank you @ozkanaltas 

[Anthony_E · Accepted solution]

Hello,

I have unarchived this content. Could you please try again?

Regards,

[Ismael_Awamleh]

Thank you it works!