Why does application control use flow based inspection mode?

[armagandarilmaz]

Hi,

I really wonder why application control uses flow-based inspection rather than proxy-based. Is there anyone to explain that or share some documents related to that.

[bommi]

Application control is build on top of the ips-engine and the ips-engine itself is flow-mode only.

[armagandarilmaz]

Okay I know that, but is there any specific reason to do that? Can the reason is that flow-based doesn’t operate using built-in protocol states?

[tanr]

A good overview is "Life of a Packet" - http://help.fortinet.com/fos50hlp/56/Content/FortiOS/fortigate-life-of-packet/LOP_intro.htm, especially the sections on UTM/NGFW packet flow for flow-based and proxy-based inspection.

[armagandarilmaz]

Thank you for your help.