Flow Mode versus Proxy Mode

[hexe]

When Anti-maleware is deployed in the Flow Mode (versus Proxy Mode), what happens to the detection rate? - It dramatically decreases - it decreases slightly - stays the same - increases

[hklb]

Hello, flowbase : faster, but less secure proxy : slower, but more secure (as the name suggest, the flow is proxied, like this the client isn' t directly connected to the server, and the fortigate has the entire file to do the security scan) For best performance, use the same mode for all your scan (AS, IPS, AV, ...).

[Baptiste]

Hmm, this is a question for NSE1 quiz, not sure this is the good place for this post (and for your first post)....

[Baptiste]

And Hello, .... Thanks ... You' re Welcome

[vanc]

With FOS 5.2.1, flow based AV now uses the same AV engine for virus scanning. Security wise, it' s comparable with proxy. In general flow based solution is faster, but provides a smaller feature set than proxy.

[Holy]

can someone explain how it should work for 5.2.0 /1. Fortinet says you have now the speed of flow based and security of proxy based. if That' s functioning properly, then it is a huge performance boost, because as you know from the data sheet, there is (depending on Model) huge difference between proxy and flow based AV Throughput. I don´t really get, how did they do it.

[Christopher_McMullan]

Haha, if we told you that...

[Adrian_Buckley_FTNT]

What makes proxymode slow is not the act of AV scanning the file. It' s the act of being a proxy and all that middle man work, handshaking, buffering, making sure the TCP session for both sides were in the proper state ... i could go on. Flow based AV in 5.0 used a separate AV engine linked to IPS. The idea being that the speed came from how IPS scanning itself works. 5.2 uses the proxy scan engine (HEY memory resources are saved because there is no longer a totally separate AV database to download). It does this by buffering the file in memory (not on the wire) and sending it to the AV engine when it detects end of file. So speed wise the only delay is holding onto that last packet. AV is clean, the last packet gets sent memory is flushed. Unless the file is something messy like multiple nested archives or an unknown compression format the act of scanning the file itself takes very little time.

[storaid]

hi, I have question.. now for v5.2.1, the flow mode has provided the same accuracy for security with proxy mode??

[Adrian_Buckley_FTNT]

That really depends on the nature of the inaccuracy in the first place. Flow mode still looks at the data as a stream. So if it can' t properly identify the beginning and end of a file transfer then the new format for the AV scanning won' t make any difference. Improved accuracy will come from looking at a file as a whole, rather then chunks. Proxy based inspection doesn' t suffer from that because it' s in the middle doing the exchange both sides, so it knows exactly where the beginning and end is.