Flow vs proxy based UTM best practices

[Jeff_Roback]

I'm curious what people are doing / finding in terms of flow based vs. proxy based antivirus at this point. 

I noticed in the 5.6.3 release notes that for new installs they're hiding the option for proxy based services from the GUI and you have to go to the CLI to even turn it on.  But I'm wondering if this is a marketing thing about driving people who do performance tests to use it in flow mode... or if they truly think most customers should be using flow mode at this point.  

The documentation hedges the bets a bit by implying that if you really really need good protection you should probably use proxy mode but otherwise flow mode is just super.

I tried out flow mode when it first came out and had really bad results... so I'm a bit hesitant at this point.   I know it's a completely rewritten feature at this point... but  overall I'm wondering what the tradeoff is for performance/security/lack of problems for proxy vs. flow.

Anyone have any experience they can share?

Thanks!

[Carl_Wallmark]

Im a proxy mode guy, as long as you dont have performance issues, go with proxy mode, it will give you a better security. There was a release some time ago that stated flow mode was as good as proxy but soon after the release that statement was gone. Proxy mode will always be better because the engine will have more data and time to unpack the files and also have a bigger picture of the files it is scanning. Proxy = better catch rate. Flow = better performance.

[tanr]

That's quite a change from 5.4, where they default to proxy and the docs say it is the best option.  Talking with Fortinet sales and support, though, they seemed to expect that most big 5.4.x installations would be using flow mode.

I wonder what the docs say about proxy vs. flow in the 6.0 docs...

[terry_miesse]

I'm doing an upgrade to 5.6.3 and have been using proxy mode for a while now.  The one advantage I see (from reading) is that you can use session pickup to fail sessions over with flow mode but not with proxy.  The docs are a bit sketchy on this - anybody tried this? (ref. http://help.fortinet.com/fos50hlp/56/Content/FortiOS/fortigate-high-availability/HA_failoverSessPick...)

[neonbit]

@terry - I tested this scenario out and can confirm this.

I had a policy with any proxy based security profiles (AV or Web filtering) and downloaded a file. If I cause a HA failover then the file stops downloading.

If I change the security profiles to flow mode then causing a HA failover doesn't stop the file from downloading.

[emnoc]

I'm proxy-mode also and it works great with  very little  issues. It's better from a management and function, and needed if your doing explicit proxy. The  performance number might take a hit if you have XXXXX amount of session proxy'd but outside of that, it's rock solid.

Ken

[Bruno_Pereira]

What I do not understand is why the installation comes with flow mode and FortiNet gives us no solid insight into this. The documentation on this is awful.

[bommi]

I try to only use the flow-mode, as hardware acceleration is only possible with flow-mode only security profiles.

Regards

bommi

[emnoc]

What I do not understand is why the installation comes with flow mode and FortiNet gives us no solid insight into this. The documentation on this is awful.

They kinda of  briefly discuss it but not in detail.

http://help.fortinet.com/fos50hlp/56/Content/FortiOS/fortigate-security-profiles/Inspection%20Modes/...

[forti_ogg]

We're using flow based at the moment due to recommendations from our distributor.

But we no seems to be hitting a bug...  We have webfilter set ut to block everything exepct certian url's. But regardless of what we do, we can't seem to be able to block facebook using that technique.

Had fortinet support online for two hours today without them being able to figure it out...

Tried it now on a test 60D unit, and are able to reproduce the same result in flow mode.

And when I change the vdom to proxy mode it is, in fact, able to block facebook. With the exact same policy and webfilter.

Anyone else seen this behavior?

So I guess we now have to consider changing from flow to proxy.. Any tips on things to verify before we make this change?  

From what I've been told performance could suffer if we switch, any performance counters we should be aware of before we consider to do the switch on our production system?

Regards 

Grondalen

Sorry didn't see this was a antivirus thread at first. 

I've posted a a new question for this in the webfilter section instead.

https://forum.fortinet.com/tm.aspx?tree=true&m=161433&mpage=1