Hi
I am really confused about flow based and proxy based on firewall policy. When should i use either of these? Fkr example i have 7 servet facing on internet and i configured antivirus,ips and i want to config WAF too but it requires to use proxy based but all other security profiles configured in flow based mode. What should i do?
Solved! Go to Solution.
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
Hi @rezafathi,
Only the first policy will be matched. You can configure a policy with the security profiles av, web, DNS, IPS and WAF and Proxy-based inspection.
Best regards,
Erlin
If you have found a solution, please like and accept it to make it easily accessible to others.
Hello
You can have some rules using flow based and some others using proxy based. You can specify at policy level.
As far as I remember, in some old FOS versions (6.?) you select the mode globally in System > Settings (but I'm not sure).
Hello,
FOS version 6.4 and newer version you can have the inspection mode per policy.
http://docs.fortinet.com/document/fortigate/6.4.0/administration-guide/366651
The following helps explaining the different explained inspection mode.
http://docs.fortinet.com/document/fortigate/6.2.0/cookbook/721410/about-inspection-modes
regards,
Hi @rezafathi
In Flow-based inspection:
The FortiGate will not buffer traffic flowing through the policy. Flow-based inspection needs lower processing resources than proxy-based inspection and does not change packets unless a threat is found and packets are blocked.
In Proxy-based inspection:
The FortiGate will buffer traffic flowing through the policy for inspection which means that the FortiGate will hold the packets for a file, email message, or web page until the entire payload is inspected for violations (virus, spam, or malicious web links). After FortiOS finishes the inspection, the payload is either released to the destination (if the traffic is clean) or dropped and replaced with a replacement message (if the traffic contains violations).
Proxy-based inspection needs more resources than Flow-based and is usually slower than flow-based
https://docs.fortinet.com/document/fortigate/7.4.0/administration-guide/969330/proxy-mode-inspection
Best regards,
Erlin
Thanks. I have vips configured for 7 servers. Can i have a policy in flow based mode for av,web,dns,application,ips and a second policy in proxy mode for waf?
Hi @rezafathi
Yes, you can configure different firewall policies, but the FortiGate will match the first policy for the traffic that is running and will not check the other firewall policies that are below that policy.
Best regards,
Erlin
If you have found a solution, please like and accept it to make it easily accessible to others.
I mean can i have above 2 policies for protecting my servers? Or only first policy will be selected. I want to secure my servers with av,web,dns,ips and waf. But waf works in proxy mode. What should i do?
Hi @rezafathi,
Only the first policy will be matched. You can configure a policy with the security profiles av, web, DNS, IPS and WAF and Proxy-based inspection.
Best regards,
Erlin
If you have found a solution, please like and accept it to make it easily accessible to others.
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.