flow based vs proxy based

[unknown1020]

Good morning friends, how are you?

One question, what is the difference between these inspection modes: flow based and proxy based, when creating a policy?

[akushwaha]

Hi,

As I undesrstand you want to know the difference between Flow based and Proxy based Policy.
Please refer to the below documents  regarding this:
Flow Based: 

https://docs.fortinet.com/document/fortigate/7.4.0/administration-guide/659145/flow-mode-inspection...

Proxy Based :
https://docs.fortinet.com/document/fortigate/7.4.0/administration-guide/969330/proxy-mode-inspection

Regards,

Abhimanyu

[parteeksharma]

Hi unknown1020,

In Flow based inspection:  Traffic flowing through the policy will not be buffered by the FortiGate. Flow-based inspection needs lower processing resources than proxy-based inspection and does not change packets, unless a threat is found and packets are blocked.

In Proxy based inspection: Traffic flowing through the policy will be buffered by the FortiGate for inspection which means that the packets for a file, email message, or web page will be held by the FortiGate until the entire payload is inspected for violations (virus, spam, or malicious web links). After FortiOS finishes the inspection, the payload is either released to the destination (if the traffic is clean) or dropped and replaced with a replacement message (if the traffic contains violations). 
Proxy based inspection needs more resources than Flow based and usually slower than flow based inspection.

Regards,
Parteek

[pgautam]

Hi,

Flow-Based:-

Flow-based UTM/NGFW inspection identifies and blocks security threats in real-time as they are identified using a single-pass architecture that involves Direct Filter Approach (DFA) pattern matching to identify possible attacks or threats.

If a firewall policy is configured for flow-based inspection, depending on the options selected in the firewall policy that accepted the session, flow-based inspection can apply IPS, Application Control, Web Filtering, DLP, Botnet checking, and AntiVirus. Flow-based inspection is all done by the IPS engine and as you would expect, no proxying is involved.

IPS, Botnet checking, and Application Control are only applied using flow-based inspection. Web Filtering, DLP, and Antivirus can also be applied using proxy-based inspection.

Note:-
Flow-based DLP is supported but not recommended. Flow-based DLP is not available from the GUI, but can be configured from the CLI.

Sniffer-policy and interface-policy are supported only in flow-based inspection.

Proxy-policy is supported in mixed flow-based and proxy-based inspection mode; but the inspection mode is assumed to be proxy-mode and is not configurable.

Proxy Based:-

If a firewall policy is configured for proxy-based inspection then a mixture of flow-based and proxy-based inspection occurs. Packets initially encounter the IPS engine, which uses the same steps described in UTM/NGFW packet flow: flow-based inspection to apply single-pass IPS, Botnet checking, and Application Control if configured in the firewall policy accepting the traffic.

Proxy-based inspection extracts and caches content, such as files and web pages, from content sessions and inspects the cached content for threats. Content inspection happens in the following order: VoIP inspection, DLP, Email Filter (Anti-Spam), Web Filtering, AntiVirus, and ICAP.

If no threat is found the proxy relays the content to its destination. If a threat is found the proxy can block the threat and replace it with a replacement message.

Please check below link for the life of a packet on fortigate.

https://docs.fortinet.com/document/fortigate/6.4.0/parallel-path-processing-life-of-a-packet/466137/...

Regards

Priyanka

[mgoswami]

Hi,

I understand that you want to know the difference between flow based and proxy based inspection mode.

You may refer to this link for more info:

https://docs.fortinet.com/document/fortigate/7.4.0/administration-guide/721410/inspection-modes#:~:t....

BR,

Manosh

[Raynottes]

Flow-based inspection checks traffic in real-time as it passes through, needing fewer resources and not holding packets unless there's a threat. Proxy-based inspection, on the other hand, buffers traffic for a deeper check, holding packets until they're fully inspected. This method uses more resources and can be slower.
Well, if you're dealing with web scraping or data gathering, try proxyrotator.com for some rotating mobile proxies. They offer some real mobile IPs, which can make the process smoother and less detectable.