Flow based or proxy based

[rezafathi]

Hi

I am really confused about flow based and proxy based on firewall policy. When should i use either of these? Fkr example i have 7 servet facing on internet and i configured antivirus,ips and i want to config WAF too but it requires to use proxy based but all other security profiles configured in flow based mode. What should i do?

[AEK]

Hello

You can have some rules using flow based and some others using proxy based. You can specify at policy level.

As far as I remember, in some old FOS versions (6.?) you select the mode globally in System > Settings (but I'm not sure).

[hhasny]

Hello,

FOS version 6.4 and newer version you can have the inspection mode per policy.

http://docs.fortinet.com/document/fortigate/6.4.0/administration-guide/366651

The following helps explaining the different explained inspection mode.

http://docs.fortinet.com/document/fortigate/6.2.0/cookbook/721410/about-inspection-modes

regards,

[esalija]

Hi @rezafathi 

In Flow-based inspection: 

 The FortiGate will not buffer traffic flowing through the policy. Flow-based inspection needs lower processing resources than proxy-based inspection and does not change packets unless a threat is found and packets are blocked.

https://docs.fortinet.com/document/fortigate/7.4.0/administration-guide/659145/flow-mode-inspection....

In Proxy-based inspection:

The FortiGate will buffer traffic flowing through the policy for inspection which means that the FortiGate will hold the packets for a file, email message, or web page until the entire payload is inspected for violations (virus, spam, or malicious web links). After FortiOS finishes the inspection, the payload is either released to the destination (if the traffic is clean) or dropped and replaced with a replacement message (if the traffic contains violations). 
Proxy-based inspection needs more resources than Flow-based and is usually slower than flow-based
https://docs.fortinet.com/document/fortigate/7.4.0/administration-guide/969330/proxy-mode-inspection

Best regards,

Erlin

[rezafathi]

Thanks. I have vips configured for 7 servers. Can i have a policy in flow based mode for av,web,dns,application,ips and a second policy in proxy mode for waf?

[esalija]

Hi @rezafathi 

Yes, you can configure different firewall policies, but the FortiGate will match the first policy for the traffic that is running and will not check the other firewall policies that are below that policy.

https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-policy-order-in-works-on-FortiGate/ta-...

Best regards,

Erlin

If you have found a solution, please like and accept it to make it easily accessible to others.

[rezafathi]

I mean can i have above 2 policies for protecting my servers? Or only first policy will be selected. I want to secure my servers with av,web,dns,ips and waf. But waf works in proxy mode. What should i do?

[esalija · Accepted solution]

Hi @rezafathi,

Only the first policy will be matched. You can configure a policy with the security profiles av, web, DNS, IPS and WAF and Proxy-based inspection.

Best regards,

Erlin

If you have found a solution, please like and accept it to make it easily accessible to others.