Mix of Flow & Proxy mode Security Profile

[sebastan_bach]

Hi, 

I am finding the new 5.4 documentation little confusing. So I am not sure if can we use mix of security profiles in flow & proxy mode. Like we would like to use App-Control,IPS in Flow mode but web-filtering & AV scanning in proxy mode for maximum security. 

Is this configuration supported. 

Kindly please let me know. 

Regards

Sebastan

[tanr]

Thanks for the description vjoshi.

So, with 5.4.1, if I have a policy using IPS (or Application Control or SSL-SSH inspection) I can use other, proxy only, profiles like DNS Filter or the proxy version of AV in the same policy, but I might see a performance hit?

Would you recommend that if I use IPS for most security policies that I use flow versions of AV and Web Filter in those policies?

Or is the performance difference not going to be all that much with a 300D? I'm currently seeing less than 45% memory usage and less than 30% CPU. I haven't put the system under much load yet, but most of that load will be between distributed render nodes that require minimal security policies. The 100D at the offsite location might be another story.

[boneyard]

awesome another opinion on the flow vs proxy discussion from Fortinet (i assume only actual Fortinet people have FTNT behind there name). so far my SE says something, support says something different in this thread there are two Fortinet people saying things, then the manual has some small sections on certain specific situations. this really annoys me, why can Fortinet write a good KB or such explaining this exactly.

for reference the manual says that combining profiles in proxy mode with application control doesn't work correctly, thereby excluding that combination, of course you can still configure it, so why make that then not impossible.

[vjoshi_FTNT]

Hello Tanr,

It is a best practice to avoid usage of mixed profiles(proxy and flow) with respect to the resource usage of the Fortigate.

If there are issues with the feature itself not working because of this, I feel that needs an indepth analysis from support

Cheers!

[tanr]

I saw some problems with mixed proxy and flow profiles in 5.4.0.  Haven't seen obvious problems in 5.4.1 yet, though I admit I have a couple rules with App Control (flow mode only) and DNS filter (proxy mode only).

@boneyard - Could you point me to the document and location where you read that proxy mode profiles don't work with application control?

@vjoshi -

It's frustrating that, with the FGT in proxy mode, I have to go the CLI to change AV or Web Filter profiles to flow mode and that I must use the CLI to add flow mode profiles to a policy that uses (flow mode only) IPS or SSL Inspection, if that is the recommended best practice.  

If having all flow mode (or all proxy mode) profiles in a policy is considered best practice, it would be great if the GUI was helpful in implementing this and warning if there were mode conflicts.   Perhaps I should make an official feature request for this?

[boneyard]

page 62 from http://docs.fortinet.com/...profiles-guide-528.pdf

Enabling the Web Filter profile to block a particular category and enabling the Application Control profile will not result in blocking the URL. This occurs because Proxy and Flow based profiles cannot operate together. To ensure replacement messages show up for blocked URLs, switch the Web Filter to Flow based inspection.

this kinda rules out web filter (and anti virus) in proxy mode if you also want to use Application Control. my follow up question would be if this is the only one exception or if IPS might also have issues. by then you almost have made proxy mode unusable.

[tanr]

I found what I think is the same section, on Advanced web filter configurations, in the 5.4.1 online docs, from http://help.fortinet.com/fos50hlp/54/Content/FortiOS/fortigate-security-profiles-54/Web_Filter/Advan....

Enabling the Web Filter profile to block a particular category and enabling the Application Control profile will not result in blocking the URL. This occurs because proxy and flow-based profiles cannot operate together. To ensure replacement messages show up for blocked URLs, switch the Web Filter to flow-based inspection.

In both cases the documentation's wording is pretty circuitous, but I don't think it's saying you *can't* have Web Filter and App Control, it's saying that you should change the Web Filter to be flow-based to make this work correctly.

My frustration in my previous post is because:

1. This sort of possible problem between flow and proxy based profiles isn't consistently documented - a table of which profiles work together correctly in which modes would avoid a lot of problems.

2. The default mode for the FortiGate (proxy) gives you proxy based AV and Web Filter, but gives you no warning about possible problems when you mix them with flow based Application Control, DNS Filter, or IPS.

3. The 5.4.x GUI hides flow based profiles if your FortiGate is in proxy mode and doesn't make them available to add to a policy.  The GUI also doesn't let you create flow-based profiles if you're in proxy mode.

[boneyard]

i totally agree with you tanr, this should be documented better. i asked support, they denied to do so stating that you shouldn't mix flow and proxy at all (without going into the profiles that only have flow mode), working on my SE but no high hopes there either.

[tanr]

One other detail.  Flow-mode Web Filters don't support Category Usage Quotas, but the proxy mode Web Filters do support quotas.

Unfortunately, I had been planning on using Web Filters with category usage quotas in combination with Application Control filters.  From the documentation this won't work since the flow-mode App Control keeps proxy-mode versions of Web Filters from working correctly.

Before I give up on this, I think I'll just try it on a test system and see what happens.  Will keep you posted.

[tanr · Accepted solution]

There is some good information in the 5.4 documentation on Parallel Path Processing (Life of a Packet).  

Specifically, the UTM/NGFW flows for:

[ul]

Flow based, which is *only* flow http://help.fortinet.com/fos50hlp/54/Content/FortiOS/fortigate-life-of-packet-54/lop-packet-flow-flo...

Proxy based, which can include a mix of proxy and flow http://help.fortinet.com/fos50hlp/54/Content/FortiOS/fortigate-life-of-packet-54/lop-packet-flow-pro...[/ul]

Each time the proxy diagram includes the "IPS Engine" block, (I think) it is representing a copy of almost the entire diagram from the flow-based UTM, though with the SSL Inspection decryption being done by the proxy engine, instead of the flow one.  So definitely more resource intensive.

I'd really like to see how that diagram changes with, for instance, a FortiGate in Proxy mode and a security policy that uses flow-mode AntiVirus, flow-mode Web Filter, App Control (flow-mode only), IPS (flow-mode only) and SSL Inspection.  Is the proxy engine still being used to decrypt and encrypt the SSL in that case, even though nothing else is using it?  Or do I still have the extra cost of the proxy engine encrypting and decrypting in this situation.

[jodros]

I am very interested in this thread as I am researching a similar topic.