Flow Mode versus Proxy Mode

[hexe]

When Anti-maleware is deployed in the Flow Mode (versus Proxy Mode), what happens to the detection rate? - It dramatically decreases - it decreases slightly - stays the same - increases

[Nihas]

Hi , I have a question. So how the uncompressed file size impact an antivirus scan? I believe that, in 5.2 both proxy and flow uses the file buffering to scan. By default the uncompressed size limit is 12MB, does that mean the FG will bypass all the files which has more than 12 MB file size? I always getting the " File reached uncompressed size limit" warning. Q1. What is the optimal uncompressed size limit ? Q2. How can be effectively scan all files which pass through the FG?

[ede_pfau]

answers: yes, files are scanned up to the limit and bypassed or blocked if larger (if their size is not known in advance), or bypassed/blocked entirely if larger if their size is known. The rationale behind this: size matters for malware spreading. The smaller the file the more attempted infections. Or less cost. A survey of viruses in the wild showed that there are neglible numbers of (known) specimen larger than 2-3 MB. Setting the limit higher will only waste ressources. Compare the risk of encountering an oversize infected file to the risk of not recognizing a virus at all. Q1: 2-3 MB Q2: you can' t. There is a limit to every ressource. I' ve heard of mail bombs the size of a CD. Most probably your (mail) provider will refuse to transfer really large files. You may of course use flow mode which inherently is independent of file size. If you do that then please use the advanced flow mode in FOS 5.2.1 for higher detection rates. Still, if archives are encountered, flow mode has to revert to proxy mode in order to unpack the load (or sort of, FTN SE' s would like to bash me for this). Clearly, just my 2 cents.

[Nihas]

Excellent .. Thanks !

Still, if archives are encountered, flow mode has to revert to proxy mode in order to unpack the load

Actually I am using flow based AV profile every where. And I am getting the uncompressed file reached message quite often.

flow mode has to revert to proxy mode in order to unpack the load

Does that mean the flow mode will not scan any archived files.? And if we want to do we have to use the proxy one. Am I understand this correctly? Or were you saying that even if we use flow mode also, it will automatically revert to proxy while scanning archived files? Thanks a lot.! :)

[ede_pfau]

Now, I haven' t been involved with development but from what I' ve heard from SEs the file will be " buffered" in memory in flow mode. For me, that is quite the same as a proxy but faster. There is an end to RAM in any Fortigate so the oversize limit still holds. Flow mode has been enhanced a lot in v5.2.1. Now even archives are scanned after unpacking in memory. Having this obstacle removed I tend to prefer flow mode for performance reasons. If the FGT is running 5.2.1, that is.

[Jeff_Roback]

ede_pfau wrote:
Flow mode has been enhanced a lot in v5.2.1. Now even archives are scanned after unpacking in memory. Having this obstacle removed I tend to prefer flow mode for performance reasons. If the FGT is running 5.2.1, that is.

We deployed flow mode briefly in 5.2.0 but immediately found certain websites stopped working.   No errors were given at the client browser or in the fortigate... the websites just wouldn't respond.    Didn't do extensive troubleshooting... just switched back to proxy and all was fine again.   Were there any known issues around this that were resolved in 5.2.1?  If not I'm kinda hesitant to try it again.

[vanc]

Jeff Roback wrote:

ede_pfau wrote:
Flow mode has been enhanced a lot in v5.2.1. Now even archives are scanned after unpacking in memory. Having this obstacle removed I tend to prefer flow mode for performance reasons. If the FGT is running 5.2.1, that is.

We deployed flow mode briefly in 5.2.0 but immediately found certain websites stopped working.   No errors were given at the client browser or in the fortigate... the websites just wouldn't respond.    Didn't do extensive troubleshooting... just switched back to proxy and all was fine again.   Were there any known issues around this that were resolved in 5.2.1?  If not I'm kinda hesitant to try it again.

I can confirm there are bunch of bugs in flow AV in 5.2.1, and fixed in 5.2.2 which is released today. Bugs including memory leak and file descriptor leak which may lead to unresponsiveness.

So far, I'm running 5.2.2 and it's working just fine.

[Holy]

So with 5.2.2 there is no reason to choose proxy mode? it´s only slows down the performance then?

[mariano_lavia]

vanc wrote:

Jeff Roback wrote:

ede_pfau wrote:
Flow mode has been enhanced a lot in v5.2.1. Now even archives are scanned after unpacking in memory. Having this obstacle removed I tend to prefer flow mode for performance reasons. If the FGT is running 5.2.1, that is.

We deployed flow mode briefly in 5.2.0 but immediately found certain websites stopped working.   No errors were given at the client browser or in the fortigate... the websites just wouldn't respond.    Didn't do extensive troubleshooting... just switched back to proxy and all was fine again.   Were there any known issues around this that were resolved in 5.2.1?  If not I'm kinda hesitant to try it again.

I can confirm there are bunch of bugs in flow AV in 5.2.1, and fixed in 5.2.2 which is released today. Bugs including memory leak and file descriptor leak which may lead to unresponsiveness.

So far, I'm running 5.2.2 and it's working just fine.

I'm running 5.2.2 on a two FG240D HA cluster (active-active), but I still have a similar problem with flow mode AV: certain websites stopped working (no response), no errors logged; hitting browser "reload/refresh" button on the client will show the page. It is quite random but frequent and annoying, making the flow mode unusable.

Is it a common problem or is just me?

[Nihas]

Thanks for the clarification. :)

[AndreaSoliva · Accepted solution]

Hi all

it is of sure a document which does not give all answers but some will be answered.

My favour mode is still proxy mode which means as long as I do not have any performance issue I would use proxy mode. If you have problems with performance I would change to flow.

Search in google for following file:

Fortios-scanning-of-archive-compressed-files

You will find a Fortinet Document Fortios-scanning-of-archive-compressed-files.pdf. As mentioned it gives some answeres in some discussed stuff here.

have fun....

Andrea