Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
Jeff_Roback
Contributor

Flow vs proxy based UTM best practices

I'm curious what people are doing / finding in terms of flow based vs. proxy based antivirus at this point. 

 

I noticed in the 5.6.3 release notes that for new installs they're hiding the option for proxy based services from the GUI and you have to go to the CLI to even turn it on.  But I'm wondering if this is a marketing thing about driving people who do performance tests to use it in flow mode... or if they truly think most customers should be using flow mode at this point.  

 

The documentation hedges the bets a bit by implying that if you really really need good protection you should probably use proxy mode but otherwise flow mode is just super.

 

I tried out flow mode when it first came out and had really bad results... so I'm a bit hesitant at this point.   I know it's a completely rewritten feature at this point... but  overall I'm wondering what the tradeoff is for performance/security/lack of problems for proxy vs. flow.

 

Anyone have any experience they can share?

 

Thanks!

Jeff Roback

Jeff Roback
12 REPLIES 12
Carl_Wallmark
Valued Contributor

Im a proxy mode guy, as long as you dont have performance issues, go with proxy mode, it will give you a better security. There was a release some time ago that stated flow mode was as good as proxy but soon after the release that statement was gone. Proxy mode will always be better because the engine will have more data and time to unpack the files and also have a bigger picture of the files it is scanning. Proxy = better catch rate. Flow = better performance.

FCNSA, FCNSP
---
FortiGate 200A/B, 224B, 110C, 100A/D, 80C/CM/Voice, 60B/C/CX/D, 50B, 40C, 30B
FortiAnalyzer 100B, 100C
FortiMail 100,100C
FortiManager VM
FortiAuthenticator VM
FortiToken
FortiAP 220B/221B, 11C

FCNSA, FCNSP---FortiGate 200A/B, 224B, 110C, 100A/D, 80C/CM/Voice, 60B/C/CX/D, 50B, 40C, 30BFortiAnalyzer 100B, 100CFortiMail 100,100CFortiManager VMFortiAuthenticator VMFortiTokenFortiAP 220B/221B, 11C
tanr
Valued Contributor II

That's quite a change from 5.4, where they default to proxy and the docs say it is the best option.  Talking with Fortinet sales and support, though, they seemed to expect that most big 5.4.x installations would be using flow mode.

 

I wonder what the docs say about proxy vs. flow in the 6.0 docs...

terry_miesse

I'm doing an upgrade to 5.6.3 and have been using proxy mode for a while now.  The one advantage I see (from reading) is that you can use session pickup to fail sessions over with flow mode but not with proxy.  The docs are a bit sketchy on this - anybody tried this? (ref. http://help.fortinet.com/fos50hlp/56/Content/FortiOS/fortigate-high-availability/HA_failoverSessPick...)

neonbit

@terry - I tested this scenario out and can confirm this.

 

I had a policy with any proxy based security profiles (AV or Web filtering) and downloaded a file. If I cause a HA failover then the file stops downloading.

 

If I change the security profiles to flow mode then causing a HA failover doesn't stop the file from downloading.

 

emnoc
Esteemed Contributor III

I'm proxy-mode also and it works great with  very little  issues. It's better from a management and function, and needed if your doing explicit proxy. The  performance number might take a hit if you have XXXXX amount of session proxy'd but outside of that, it's rock solid.

 

Ken

 

PCNSE 

NSE 

StrongSwan  

PCNSE NSE StrongSwan
Bruno_Pereira
New Contributor III

What I do not understand is why the installation comes with flow mode and FortiNet gives us no solid insight into this. The documentation on this is awful.

bommi

I try to only use the flow-mode, as hardware acceleration is only possible with flow-mode only security profiles.

Regards

bommi

NSE 4/5/7

NSE 4/5/7
emnoc
Esteemed Contributor III

What I do not understand is why the installation comes with flow mode and FortiNet gives us no solid insight into this. The documentation on this is awful.

 

They kinda of  briefly discuss it but not in detail.

 

http://help.fortinet.com/fos50hlp/56/Content/FortiOS/fortigate-security-profiles/Inspection%20Modes/...

 

 

PCNSE 

NSE 

StrongSwan  

PCNSE NSE StrongSwan
forti_ogg

 

 

 

We're using flow based at the moment due to recommendations from our distributor.

But we no seems to be hitting a bug...  We have webfilter set ut to block everything exepct certian url's. But regardless of what we do, we can't seem to be able to block facebook using that technique.

Had fortinet support online for two hours today without them being able to figure it out...

 

Tried it now on a test 60D unit, and are able to reproduce the same result in flow mode.

And when I change the vdom to proxy mode it is, in fact, able to block facebook. With the exact same policy and webfilter.

 

 

Anyone else seen this behavior?

 

So I guess we now have to consider changing from flow to proxy.. Any tips on things to verify before we make this change?  

From what I've been told performance could suffer if we switch, any performance counters we should be aware of before we consider to do the switch on our production system?

 

Regards 

Grondalen

 

 

Sorry didn't see this was a antivirus thread at first. 

I've posted a a new question for this in the webfilter section instead.

https://forum.fortinet.com/tm.aspx?tree=true&m=161433&mpage=1

 

Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors