I'm curious what people are doing / finding in terms of flow based vs. proxy based antivirus at this point.
I noticed in the 5.6.3 release notes that for new installs they're hiding the option for proxy based services from the GUI and you have to go to the CLI to even turn it on. But I'm wondering if this is a marketing thing about driving people who do performance tests to use it in flow mode... or if they truly think most customers should be using flow mode at this point.
The documentation hedges the bets a bit by implying that if you really really need good protection you should probably use proxy mode but otherwise flow mode is just super.
I tried out flow mode when it first came out and had really bad results... so I'm a bit hesitant at this point. I know it's a completely rewritten feature at this point... but overall I'm wondering what the tradeoff is for performance/security/lack of problems for proxy vs. flow.
Anyone have any experience they can share?
Thanks!
Jeff Roback
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
FCNSA, FCNSP
---
FortiGate 200A/B, 224B, 110C, 100A/D, 80C/CM/Voice, 60B/C/CX/D, 50B, 40C, 30B
FortiAnalyzer 100B, 100C
FortiMail 100,100C
FortiManager VM
FortiAuthenticator VM
FortiToken
FortiAP 220B/221B, 11C
That's quite a change from 5.4, where they default to proxy and the docs say it is the best option. Talking with Fortinet sales and support, though, they seemed to expect that most big 5.4.x installations would be using flow mode.
I wonder what the docs say about proxy vs. flow in the 6.0 docs...
I'm doing an upgrade to 5.6.3 and have been using proxy mode for a while now. The one advantage I see (from reading) is that you can use session pickup to fail sessions over with flow mode but not with proxy. The docs are a bit sketchy on this - anybody tried this? (ref. http://help.fortinet.com/fos50hlp/56/Content/FortiOS/fortigate-high-availability/HA_failoverSessPick...)
@terry - I tested this scenario out and can confirm this.
I had a policy with any proxy based security profiles (AV or Web filtering) and downloaded a file. If I cause a HA failover then the file stops downloading.
If I change the security profiles to flow mode then causing a HA failover doesn't stop the file from downloading.
I'm proxy-mode also and it works great with very little issues. It's better from a management and function, and needed if your doing explicit proxy. The performance number might take a hit if you have XXXXX amount of session proxy'd but outside of that, it's rock solid.
Ken
PCNSE
NSE
StrongSwan
What I do not understand is why the installation comes with flow mode and FortiNet gives us no solid insight into this. The documentation on this is awful.
I try to only use the flow-mode, as hardware acceleration is only possible with flow-mode only security profiles.
Regards
bommi
NSE 4/5/7
What I do not understand is why the installation comes with flow mode and FortiNet gives us no solid insight into this. The documentation on this is awful.
They kinda of briefly discuss it but not in detail.
PCNSE
NSE
StrongSwan
We're using flow based at the moment due to recommendations from our distributor.
But we no seems to be hitting a bug... We have webfilter set ut to block everything exepct certian url's. But regardless of what we do, we can't seem to be able to block facebook using that technique.
Had fortinet support online for two hours today without them being able to figure it out...
Tried it now on a test 60D unit, and are able to reproduce the same result in flow mode.
And when I change the vdom to proxy mode it is, in fact, able to block facebook. With the exact same policy and webfilter.
Anyone else seen this behavior?
So I guess we now have to consider changing from flow to proxy.. Any tips on things to verify before we make this change?
From what I've been told performance could suffer if we switch, any performance counters we should be aware of before we consider to do the switch on our production system?
Regards
Grondalen
Sorry didn't see this was a antivirus thread at first.
I've posted a a new question for this in the webfilter section instead.
https://forum.fortinet.com/tm.aspx?tree=true&m=161433&mpage=1
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1547 | |
1031 | |
749 | |
443 | |
210 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.