- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Flow based or proxy based
Hi
I am really confused about flow based and proxy based on firewall policy. When should i use either of these? Fkr example i have 7 servet facing on internet and i configured antivirus,ips and i want to config WAF too but it requires to use proxy based but all other security profiles configured in flow based mode. What should i do?
Solved! Go to Solution.
- Labels:
-
FortiGate
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi @rezafathi,
Only the first policy will be matched. You can configure a policy with the security profiles av, web, DNS, IPS and WAF and Proxy-based inspection.
Best regards,
Erlin
If you have found a solution, please like and accept it to make it easily accessible to others.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello
You can have some rules using flow based and some others using proxy based. You can specify at policy level.
As far as I remember, in some old FOS versions (6.?) you select the mode globally in System > Settings (but I'm not sure).
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello,
FOS version 6.4 and newer version you can have the inspection mode per policy.
http://docs.fortinet.com/document/fortigate/6.4.0/administration-guide/366651
The following helps explaining the different explained inspection mode.
http://docs.fortinet.com/document/fortigate/6.2.0/cookbook/721410/about-inspection-modes
regards,
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi @rezafathi
In Flow-based inspection:
The FortiGate will not buffer traffic flowing through the policy. Flow-based inspection needs lower processing resources than proxy-based inspection and does not change packets unless a threat is found and packets are blocked.
In Proxy-based inspection:
The FortiGate will buffer traffic flowing through the policy for inspection which means that the FortiGate will hold the packets for a file, email message, or web page until the entire payload is inspected for violations (virus, spam, or malicious web links). After FortiOS finishes the inspection, the payload is either released to the destination (if the traffic is clean) or dropped and replaced with a replacement message (if the traffic contains violations).
Proxy-based inspection needs more resources than Flow-based and is usually slower than flow-based
https://docs.fortinet.com/document/fortigate/7.4.0/administration-guide/969330/proxy-mode-inspection
Best regards,
Erlin
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks. I have vips configured for 7 servers. Can i have a policy in flow based mode for av,web,dns,application,ips and a second policy in proxy mode for waf?
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi @rezafathi
Yes, you can configure different firewall policies, but the FortiGate will match the first policy for the traffic that is running and will not check the other firewall policies that are below that policy.
Best regards,
Erlin
If you have found a solution, please like and accept it to make it easily accessible to others.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I mean can i have above 2 policies for protecting my servers? Or only first policy will be selected. I want to secure my servers with av,web,dns,ips and waf. But waf works in proxy mode. What should i do?
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi @rezafathi,
Only the first policy will be matched. You can configure a policy with the security profiles av, web, DNS, IPS and WAF and Proxy-based inspection.
Best regards,
Erlin
If you have found a solution, please like and accept it to make it easily accessible to others.
