- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Flow vs proxy based UTM best practices
I'm curious what people are doing / finding in terms of flow based vs. proxy based antivirus at this point.
I noticed in the 5.6.3 release notes that for new installs they're hiding the option for proxy based services from the GUI and you have to go to the CLI to even turn it on. But I'm wondering if this is a marketing thing about driving people who do performance tests to use it in flow mode... or if they truly think most customers should be using flow mode at this point.
The documentation hedges the bets a bit by implying that if you really really need good protection you should probably use proxy mode but otherwise flow mode is just super.
I tried out flow mode when it first came out and had really bad results... so I'm a bit hesitant at this point. I know it's a completely rewritten feature at this point... but overall I'm wondering what the tradeoff is for performance/security/lack of problems for proxy vs. flow.
Anyone have any experience they can share?
Thanks!
Jeff Roback
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
FCNSA, FCNSP
---
FortiGate 200A/B, 224B, 110C, 100A/D, 80C/CM/Voice, 60B/C/CX/D, 50B, 40C, 30B
FortiAnalyzer 100B, 100C
FortiMail 100,100C
FortiManager VM
FortiAuthenticator VM
FortiToken
FortiAP 220B/221B, 11C
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
That's quite a change from 5.4, where they default to proxy and the docs say it is the best option. Talking with Fortinet sales and support, though, they seemed to expect that most big 5.4.x installations would be using flow mode.
I wonder what the docs say about proxy vs. flow in the 6.0 docs...
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I'm doing an upgrade to 5.6.3 and have been using proxy mode for a while now. The one advantage I see (from reading) is that you can use session pickup to fail sessions over with flow mode but not with proxy. The docs are a bit sketchy on this - anybody tried this? (ref. http://help.fortinet.com/fos50hlp/56/Content/FortiOS/fortigate-high-availability/HA_failoverSessPick...)
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@terry - I tested this scenario out and can confirm this.
I had a policy with any proxy based security profiles (AV or Web filtering) and downloaded a file. If I cause a HA failover then the file stops downloading.
If I change the security profiles to flow mode then causing a HA failover doesn't stop the file from downloading.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I'm proxy-mode also and it works great with very little issues. It's better from a management and function, and needed if your doing explicit proxy. The performance number might take a hit if you have XXXXX amount of session proxy'd but outside of that, it's rock solid.
Ken
PCNSE
NSE
StrongSwan
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
What I do not understand is why the installation comes with flow mode and FortiNet gives us no solid insight into this. The documentation on this is awful.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I try to only use the flow-mode, as hardware acceleration is only possible with flow-mode only security profiles.
Regards
bommi
NSE 4/5/7
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
What I do not understand is why the installation comes with flow mode and FortiNet gives us no solid insight into this. The documentation on this is awful.
They kinda of briefly discuss it but not in detail.
PCNSE
NSE
StrongSwan
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
We're using flow based at the moment due to recommendations from our distributor.
But we no seems to be hitting a bug... We have webfilter set ut to block everything exepct certian url's. But regardless of what we do, we can't seem to be able to block facebook using that technique.
Had fortinet support online for two hours today without them being able to figure it out...
Tried it now on a test 60D unit, and are able to reproduce the same result in flow mode.
And when I change the vdom to proxy mode it is, in fact, able to block facebook. With the exact same policy and webfilter.
Anyone else seen this behavior?
So I guess we now have to consider changing from flow to proxy.. Any tips on things to verify before we make this change?
From what I've been told performance could suffer if we switch, any performance counters we should be aware of before we consider to do the switch on our production system?
Regards
Grondalen
Sorry didn't see this was a antivirus thread at first.
I've posted a a new question for this in the webfilter section instead.
https://forum.fortinet.com/tm.aspx?tree=true&m=161433&mpage=1