Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
rezafathi
Contributor II

Flow based or proxy based

Hi

 

I am really confused about flow based and proxy based on firewall policy. When should i use either of these? Fkr example i have 7 servet facing on internet and i configured antivirus,ips and i want to config WAF too but it requires to use proxy based but all other security profiles configured in flow based mode. What should i do?

Reza F.
Reza F.
1 Solution
esalija

Hi @rezafathi,

Only the first policy will be matched. You can configure a policy with the security profiles av, web, DNS, IPS and WAF and Proxy-based inspection.

 

Best regards,

Erlin

If you have found a solution, please like and accept it to make it easily accessible to others.

View solution in original post

7 REPLIES 7
AEK
SuperUser
SuperUser

Hello

You can have some rules using flow based and some others using proxy based. You can specify at policy level.

As far as I remember, in some old FOS versions (6.?) you select the mode globally in System > Settings (but I'm not sure).

AEK
AEK
hhasny

Hello,

FOS version 6.4 and newer version you can have the inspection mode per policy.

http://docs.fortinet.com/document/fortigate/6.4.0/administration-guide/366651

 

The following helps explaining the different explained inspection mode.

http://docs.fortinet.com/document/fortigate/6.2.0/cookbook/721410/about-inspection-modes

 

regards,

esalija
Staff
Staff

 

Hi @rezafathi 


In Flow-based inspection: 

 The FortiGate will not buffer traffic flowing through the policy. Flow-based inspection needs lower processing resources than proxy-based inspection and does not change packets unless a threat is found and packets are blocked.

https://docs.fortinet.com/document/fortigate/7.4.0/administration-guide/659145/flow-mode-inspection....


In Proxy-based inspection:

The FortiGate will buffer traffic flowing through the policy for inspection which means that the FortiGate will hold the packets for a file, email message, or web page until the entire payload is inspected for violations (virus, spam, or malicious web links). After FortiOS finishes the inspection, the payload is either released to the destination (if the traffic is clean) or dropped and replaced with a replacement message (if the traffic contains violations). 
Proxy-based inspection needs more resources than Flow-based and is usually slower than flow-based
https://docs.fortinet.com/document/fortigate/7.4.0/administration-guide/969330/proxy-mode-inspection

 

Best regards,

Erlin

 

rezafathi

Thanks. I have vips configured for 7 servers. Can i have a policy in flow based mode for av,web,dns,application,ips and a second policy in proxy mode for waf?

Reza F.
Reza F.
esalija
Staff
Staff

Hi @rezafathi 

Yes, you can configure different firewall policies, but the FortiGate will match the first policy for the traffic that is running and will not check the other firewall policies that are below that policy.

 

https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-policy-order-in-works-on-FortiGate/ta-...

 

Best regards,

Erlin

If you have found a solution, please like and accept it to make it easily accessible to others.

rezafathi

I mean can i have above 2 policies for protecting my servers? Or only first policy will be selected. I want to secure my servers with av,web,dns,ips and waf. But waf works in proxy mode. What should i do?

Reza F.
Reza F.
esalija

Hi @rezafathi,

Only the first policy will be matched. You can configure a policy with the security profiles av, web, DNS, IPS and WAF and Proxy-based inspection.

 

Best regards,

Erlin

If you have found a solution, please like and accept it to make it easily accessible to others.

Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors