Proxy/flow based inspection mechanism ?

[usmansa1]

Hi everyone, 

I was reading proxy based and flow based inspection. When i read the proxy based inspection mechanism it explains that the Fortigate deeply inspect the packet and flow based just check the pattern and packet is not decrypted in both cases unless we choose the SSL decryption profile.

Now if the packet is not decrypted then in that case the only thing that can be checked is the certificate or packet headers or may be some initial TCP packets. In this case, what is the purpose of having two different mechanism proxy based and flow based if only thing you can check is headers and content is all encrypted ? even the antivirus cant check all the attachments because every packet is encrypted ? so how does this work ?

[AEK]

Hello Usmansa

It is true that most internet traffic is encrypted, but inside a company this is not always true, and in such case it can make the difference to use flow based or proxy based without deep inspection.

[usmansa1]

so it seems like these mechanisms are intended to be used for internal traffic which means internal organizational traffic which is not encrypted 

[pminarik]

Indeed there is not much to inspect when looking at encrypted traffic without any attempt to decrypt it. In this scenario, the proxy- vs flow-mode distinction is rather academic and not very practical.

The distinction is meaningful primarily when dealing with non-encrypted traffic, or with traffic traffic that is being decrypted ("SSL deep inspection") and thus the inner contents are visible to the FortiGate and available for inspection.

[usmansa1]

Hi, 

thanks for your response, however i have one more question, I checked the Packet life document and other documents for inspection mode. In proxy mode inspection mechanism, the FGT cached all the contents of the payload in its buffer and then once the payload is completed, it then examine and after that it will forward to the user.

If payload is transferred via TCP from server then each packet in payload needs an acknowledgement and if the payload is cached on the FGT and not sent to the user then this means that the user is not sending the acknowledgement packet to server, so in this case my question is that will the FGT send the acknowledgement packets to server ?

[pminarik]

Yes, in proxy-mode inspection the FortiGate will independently send ACKs in the client<-->FGT and FGT<-->server sessions.

[usmansa1]

is there any reference given in any document about this, if not, I want to write community article about it, how can i do that 

[pminarik]

If it is documented, I would expect it to be present in the older guides, maybe 6.0 or 5.4 Admin Guides/Handbooks. At the same time I feel like this is "too obvious" to document. (if the FGT proxies the TCP connections, i.e. keeps them separate, then it should naturally follow that each TCP session will have it's own flow of ACKs)