Facebook blocked and not blocked with same policy

[Ambush4261]

Hello,

I have a mystery on a Fortigate.

I have a security group that block Facebook using application control and webfilter categories.

My users told by that they still can use Facebook. I checked the log and I see that most of the traffic linked to Facebook is blocked, but, I have some line with allowed traffic to facebook, using the same firewall policy. it's unbelievable, my own rules which block Facebook is also allowing it.

How this is possible ?

[fricci_FTNT]

You stated that you are using flow-based inspection.
Please try to change it to proxy-based (or clone current policy -> change new policy to proxy-based and move it above the current policy to test it) and see if you have the same behaviour.

Best regards,

[Ambush4261]

I switch to "proxy-based" and it seems to work much better, 99% of the traffic I want to block is really blocked now.

Whats the impact of settings a firewall policy to proxy-based instead of flow-based ? it will load the firewall cpu ?

[fricci_FTNT · Accepted solution]

Proxy mode can be a workaround for now.
Flow-based inspection uses hardware acceleration (where available, depends on the model), Proxy inspected traffic goes through the FortiGate main CPU.
Using Proxy mode is more CPU intensive but in normal condition should be fine, it actually depend on the traffic running through the FortiGate. Please keep on eye on the CPU (get sys performance status).

Here you can find some more details about Flow/Proxy inspection: https://docs.fortinet.com/document/fortigate/7.4.2/administration-guide/721410/inspection-modes

Best regards,