3.1 Flow-Based vs Proxy-Based Inspection Modes

3.1 Flow-Based vs Proxy-Based Inspection Modes

FortiOS security profiles operate under two primary inspection paradigms: Flow-based inspection and Proxy-based inspection. Understanding the architectural differences, engine mechanics, feature availability, and performance characteristics of these modes is essential for Fortinet FCP certification and enterprise security design.

---

Architectural Comparison

In FortiOS 7.6, security profiles evaluate network traffic to detect threats, enforce content access controls, and monitor application usage. The underlying inspection mode determines how FortiGate processes packets as they move through the system.

1. Flow-Based Inspection Mode

Flow-based inspection analyzes network traffic on a packet-by-packet or stream-chunk basis. Rather than buffering the entire payload or holding back an entire file download, the IPS engine examines incoming packets as they arrive in memory buffers.

• Engine Mechanics: Traffic passes through the IPS engine, which uses specialized pattern-matching algorithms to scan for malware signatures, protocol anomalies, and restricted web content in real time.
• Hardware Acceleration: Flow inspection leverages Fortinet Security Processing Units (SPUs) and Network Processors (NP7/NPU) alongside Content Processors (CP9) via nTurbo offloading. This bypasses the main CPU for established flows once initial session security checks pass.
• Latency & Performance: Delivers ultra-low latency and maximum throughput. It is ideal for time-sensitive applications such as VoIP, real-time video streaming, and high-gigabit internal network segments.
• Limitations: Because complete files are not buffered in memory, FortiOS cannot perform deep protocol modifications (such as injecting custom HTTP headers) or unpack complex multi-nested archives beyond fixed memory buffers. If a virus is detected mid-stream after initial HTTP headers have been delivered to the client, FortiGate cannot present an HTML block page; instead, it sends a TCP Reset (RST) packet to tear down the connection.

2. Proxy-Based Inspection Mode

Proxy-based inspection establishes the FortiGate as a dual-session intermediary (a full proxy). The client connects to the FortiGate, and the FortiGate originates a separate connection to the destination server.

• Engine Mechanics: Traffic is handled by proxy worker processes managed by the WAD (Web Application Defender / Wireless Access Controller / Proxy) daemon. The FortiGate buffers the complete application layer payload (such as an entire HTTP response, email attachment, or FTP file download) in memory before executing security profile scanning.
• Deep Protocol Inspection: Once the full object is assembled in the buffer, FortiGate inspects the content, unpacks multi-layer compressed archives, evaluates HTML body scripts, and checks headers.
• Latency & Resource Impact: Requires higher RAM allocations and CPU overhead due to connection state tracking and payload buffering. Throughput is lower compared to flow mode, and initial packet arrival at the client is delayed until payload buffering and scanning complete.
• Advanced Capabilities: Proxy mode enables advanced features including HTTP header modification/insertion, ICAP (Internet Content Adaptation Protocol) offloading to external DLP/AV servers, explicit web proxy, and consistent delivery of client replacement messages regardless of session state.

---

Inspection Mode Selection in FortiOS 7.6

In FortiOS 7.6, inspection modes can be specified flexibly:

1. System / VDOM Level: Set the default inspection mode for the VDOM under config system settings.
2. Firewall Policy Level: Override or explicitly set the inspection-mode per firewall policy (flow or proxy). This permits running high-speed flow-based rules alongside targeted proxy-based inspection policies on the same FortiGate unit.

---

CLI Configuration Examples

Setting VDOM Default Inspection Mode to Proxy

config system settings
    set inspection-mode proxy
end

Configuring a Proxy-Based Firewall Policy with Security Profiles

config firewall policy
    edit 10
        set name "Corp_Proxy_Web_Access"
        set srcintf "port2"
        set dstintf "port1"
        set srcaddr "Corp_LAN_Subnet"
        set dstaddr "all"
        set action accept
        set schedule "always"
        set service "HTTP" "HTTPS"
        set inspection-mode proxy
        set utm-status enable
        set av-profile "default-proxy"
        set webfilter-profile "Strict_Web_Filter"
        set ssl-ssh-profile "deep-inspection"
        set nat enable
    next
end

Configuring a Flow-Based Firewall Policy for High Throughput

config firewall policy
    edit 20
        set name "HighSpeed_Flow_Policy"
        set srcintf "port2"
        set dstintf "port1"
        set srcaddr "Server_Subnet"
        set dstaddr "all"
        set action accept
        set schedule "always"
        set service "ALL"
        set inspection-mode flow
        set utm-status enable
        set av-profile "default-flow"
        set ips-sensor "Critical_Servers_IPS"
        set nat enable
    next
end