- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Facebook blocked and not blocked with same policy
Hello,
I have a mystery on a Fortigate.
I have a security group that block Facebook using application control and webfilter categories.
My users told by that they still can use Facebook. I checked the log and I see that most of the traffic linked to Facebook is blocked, but, I have some line with allowed traffic to facebook, using the same firewall policy. it's unbelievable, my own rules which block Facebook is also allowing it.
How this is possible ?
Solved! Go to Solution.
- Labels:
-
FortiGate
Created on ‎02-08-2024 05:17 AM Edited on ‎02-08-2024 05:18 AM
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Proxy mode can be a workaround for now.
Flow-based inspection uses hardware acceleration (where available, depends on the model), Proxy inspected traffic goes through the FortiGate main CPU.
Using Proxy mode is more CPU intensive but in normal condition should be fine, it actually depend on the traffic running through the FortiGate. Please keep on eye on the CPU (get sys performance status).
Here you can find some more details about Flow/Proxy inspection: https://docs.fortinet.com/document/fortigate/7.4.2/administration-guide/721410/inspection-modes
Best regards,
If you have found a useful article or a solution, please like and accept it to make it easily accessible to others.
- « Previous
-
- 1
- 2
- Next »
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You stated that you are using flow-based inspection.
Please try to change it to proxy-based (or clone current policy -> change new policy to proxy-based and move it above the current policy to test it) and see if you have the same behaviour.
Best regards,
If you have found a useful article or a solution, please like and accept it to make it easily accessible to others.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I switch to "proxy-based" and it seems to work much better, 99% of the traffic I want to block is really blocked now.
Whats the impact of settings a firewall policy to proxy-based instead of flow-based ? it will load the firewall cpu ?
Created on ‎02-08-2024 05:17 AM Edited on ‎02-08-2024 05:18 AM
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Proxy mode can be a workaround for now.
Flow-based inspection uses hardware acceleration (where available, depends on the model), Proxy inspected traffic goes through the FortiGate main CPU.
Using Proxy mode is more CPU intensive but in normal condition should be fine, it actually depend on the traffic running through the FortiGate. Please keep on eye on the CPU (get sys performance status).
Here you can find some more details about Flow/Proxy inspection: https://docs.fortinet.com/document/fortigate/7.4.2/administration-guide/721410/inspection-modes
Best regards,
If you have found a useful article or a solution, please like and accept it to make it easily accessible to others.

- « Previous
-
- 1
- 2
- Next »